vulnerability

[G_W_Albrecht]

Both ports are not listed here: sk52421: Ports used by Check Point software

[Blason_R]

Those seems to be a httpd2 ports for multiportals. Since there are lot many portals running like captive portal, Mobile access portal, NAC, userChek on Apache and there are vhosts configuration done under Apache and those ports then start listening on then and has got a forwarding done internally 

e.g.

For me port 20988 listens on Apache2 which says it is opened for multiportal NAC/Captive Portal

/opt/CPshrd-R81/web/Apache/bin/httpd -DFOREGROUND -k start -f /opt/CPshrd-R81/conf/multiportal/httpd-conf/nac/httpd.conf -DPORTAL_NAME_nac

You will get more details from mpclient list command 

mpclient list
DLPSenderPortal
ExchangeRegistration
ReverseProxyClear
ReverseProxySSL
SecurePlatform
UserCheck
nac
nac_transparent_auth
saml-vpn
sslvpn

[_Val_]

First, half-open ports are not necessarily a vulnerability, even if Nessus thinks they are.  Vulnerability is something you can exploit.

Second, if you believe you indeed found a vulnerability in any of Check Point products, the only correct way to disclose it is to adhere to responsible disclose principles and to use this form 

[PhoneBoy]

We use a number of random high TCP ports to redirect certain traffic to for various reasons (Threat Prevention, UserCheck, among others).
Even there is a vulnerability there, it’s only accessible from the local system and would require root access (expert mode) to do so, which should only be provided to authorized individuals.
Which makes this “vulnerability” not interesting.

The fact a vulnerability scanner can find this suggests your access policy needs to be improved.
Best practice is to have a stealth rule in place that blocks all traffic to the gateway except for the traffic needed to manage the device.