> Source: [sk185114](https://support.checkpoint.com/results/sk/sk185114)
# sk185114 - Check Point Live Patch (CPLP)
| Property | Value |
|----------|-------|
| Solution ID | sk185114 |
| Date Created | 2026-07-01 |
| Last Modified | 2026-10-14 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server, Check Point Firewall, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Gaia |
## Solution
**CPLP Visibility \|
Online Installation and Updates \|
Manual Offline Installation and Availability \|**
**Supported Configurations \|
Known Limitations \| CLI Syntax \| FAQ \| List of Patches Installed by CPLP and Resolved Issues**
Introduction {#Introduction}
----------------------------
**Check Point Live Patch (CPLP)** is a built-in mitigation delivery service included with Gaia OS. It closes critical vulnerabilities in the field by applying targeted, in-memory fixes (Live Patches) to already-running Check Point processes, without restarting the process or rebooting the server, so protection takes effect immediately.
CPLP helps decrease the time-to-protection for critical issues and lets you decide when to install the permanent Hotfix or Jumbo Hotfix Accumulator during a planned maintenance window.
CPLP itself carries no fixes. It receives, validates, and safely applies the individual Live Patches delivered to it. Each Live Patch is a dedicated Check Point security package. CPLP runs quietly in the background as a managed service and acts as the "ready table" for Live Patches: as patches arrive, CPLP holds them and applies each one only when it is safe to do so.
* **Background service** - No manual action is required; if a patched process restarts or the Security Gateway reboots, CPLP automatically reapplies active Live Patches.
* **Safe-condition gating** - A Live Patch is applied only when CPLP can positively confirm it is safe to attach to the target process and that the patch matches the running software. Otherwise, the target process is left untouched.
* **Automatic stand-down** - When the matching Hotfix or Jumbo Hotfix Accumulator containing the fix is installed, CPLP recognizes that a fix is present and stops applying the patch.
* **Fail-Open**- CPLP monitors the health of patched processes. If a patched process crashes repeatedly, CPLP automatically disables itself, reverts the change, and stops re-applying the patch.
CPLP applies the security fix in memory, protecting against the vulnerability as soon as the package is installed, without requiring a maintenance window or reboot. Each CPLP package remains available for 12 weeks after its release, giving you time to install the corresponding Jumbo Hotfix Accumulator during a planned maintenance window. After the Jumbo Hotfix Accumulator is installed, it incorporates the fix along with all associated functionality and hardening improvements, and CPLP is automatically removed from the update path.
### CPLP Visibility {#CPLP_Visibility}
To view which CVEs are patched across your managed Security Gateways and servers, see [sk185102](https://support.checkpoint.com/results/sk/sk185102).
The Live Patch mechanism generates the following audit logs, providing a comprehensive status update in each case:
* Coverage Report - Every 7 days, the system generates a periodic summary detailing which security fixes are currently active.
* Installed - The system records when it successfully installs a Live Patch package on the Security Gateway.
* Applied - The system confirms when a security fix becomes active on the Security Gateway.
* Reverted - The system logs when it removes a security fix, indicating that the Security Gateway is now running without it.
For example:
**Health Check Point (HCP)** reads the CPLP inventory each time it runs the CVE Exposure test and generates a verdict for each CVE.
For the HCP report, run from the Expert mode: hcp -r "CVE Exposure"
Online Installation and Updates {#Online_Installation}
------------------------------------------------------
When Automatic Update downloads are enabled on the Gaia server (see [sk175504](https://support.checkpoint.com/results/sk/sk175504), section 2-B), CPLP is installed and kept up to date automatically on all Check Point servers that CPLP supports. No manual action is required. Applicable Live Patches are delivered in the same way.
If Automatic Updates are disabled on the Security Gateway or the Security Gateway has no Internet access, [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) for assistance with manual installation of the required packages. Check Point recommends keeping Automatic Updates enabled, so that critical-issue mitigations reach the Security Gateway promptly.
**How to trigger a Check Point Live Patch (CPLP) Update**
If you need to update the CPLP package immediately, without waiting for the next scheduled AutoUpdater cycle, follow the steps below in Expert mode.
1. Verify what CPLP package is currently installed: `cpinfo -y all | grep URGENT`
Example:
`admin@GW:# cpinfo -y all | grep URGENT`
`BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take: 28`
2. Stop the AutoUpdater service: `autoupdatercli stop`
Note: The AutoUpdater service restarts automatically.
3. Trigger an immediate update of the CPLP component: `autoupdatercli update_component urgent_security_updates`
4. Verify that the CPLP package was updated successfully: `cpinfo -y all | grep URGENT`
**How to disable the automatic download of Check Point Live Patch (CPLP) Update**
1. Log in to Expert mode
2. On the Security Gateway / Security Management, run: `autoupdatercli disable urgent_security_updates`
On the Scalable Platform Security Group, run: `g_all autoupdatercli disable urgent_security_updates`
Manual Offline Installation {#Manual}
-------------------------------------
### Availability
|------------|-------------------------------------------------------------|--------------|--------------------------------------------------------------------------------------------------------------------------|
| Version | Take Number | Release Date | Download Package |
| **R82.20** | BUNDLE_URGENT_SECURITY_UPDATE_R82_20_AUTOUPDATE **take 30** | 14 Oct 2026 | [](https://support.checkpoint.com/results/download/145896) (TAR) |
| **R82.10** | BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE **take 30** | 14 Oct 2026 | [](https://support.checkpoint.com/results/download/145888) (TAR) |
| **R82** | BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE **take 30** | 14 Oct 2026 | [](https://support.checkpoint.com/results/download/145889) (TAR) |
| **R81.20** | BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE **take 30** | 14 Oct 2026 | [](https://support.checkpoint.com/results/download/145883) (TAR) |
**Installation Procedure for Offline Package (Single Machine)**{#Installation}
Show / Hide the Procedure
1. Manually install the latest [AutoUpdater](https://support.checkpoint.com/results/sk/sk165653) Take.
2. Transfer the [AutoUpdater configuration file](https://support.checkpoint.com/results/download/144221) to your Server.
3. Transfer the offline package to a directory on your Server.
4. Connect to the command line on the Server.
5. Log in to Expert mode.
6. Important: first install the AutoUpdater configuration file.
On the Security Gateway / Security Management, run:
`autoupdatercli install `
On the Scalable Platform Security Group, run:
`g_all autoupdatercli install `
7. On the Security Gateway / Security Management, run: `autoupdatercli stop`
On the Scalable Platform Security Group, run: `g_all autoupdatercli stop`
8. Install the offline installation package.
On the Security Gateway / Security Management, run:
`autoupdatercli install //`
Example:
`[Expert@Host]# autoupdatercli install /var/log/urgent_security_updates_R81_20_Bundle_T21_AutoUpdate.tar`
On the Scalable Platform Security Group, run:
`g_all autoupdatercli install `
**Note** -The installation does not require a restart of Check Point services ("`cpstop; cpstart`") or a reboot. After it is installed, no further action is required. The future updates are applied immediately.
*** ** * ** ***
Supported Configurations {#Supported Configurations}
----------------------------------------------------
CPLP supports these configurations:
* Single Security Gateway / ClusterXL Members.
* Single Security Gateway / ClusterXL Members in the Traditional VSX mode.
* Scalable Platform Security Group in the Gateway / Traditional VSX / VSNext mode.
* Standalone configuration (Security Gateway and Security Management Server on the same server).
* Security Management Server / Log Server.
* Multi-Domain Security Management Server / Multi-Domain Log Management Server.
Known Limitations {#Known Limitations}
--------------------------------------
* CPLP does not support Spark Firewall appliances.
* If a private hotfix is installed, the CPLP patch does not override the process associated with that hotfix, and is installed partially.
CLI Syntax {#CLI Syntax}
------------------------
These commands are available for visibility and manual override.
1. Connect to the command line on the Security Gateway / each ClusterXL member / Security Group.
2. In the Expert mode, run:
* On a Security Gateway / ClusterXL member: cplp \
* On a Scalable Platform Security Group: g_all cplp \
Explanations:
|-------------|-------------------------------------------------------------------------------|
| Command | Description |
| `cplp list` | List all Live Patches known to the Security Gateway (see status table below). |
Each installed Live Patch appears with one of these statuses:
|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Status | Description |
| `armed` | The patch is active in the running process. The fix is currently in effect. |
| `ready` | The patch is installed and waiting. It will be applied automatically as soon as the target process starts. |
| `reverted` | The patch has been removed and is no longer in effect. |
| `jumbofix` | Your installed software is newer than this patch. The fix is expected to already be included in the installed Jumbo Hotfix, so the patch is not applied. |
| `unsupp` | This patch does not cover your installed build. It will be applied automatically once a matching patch becomes available. |
| `nopatch` | No patch is available for your version or platform, so there is nothing to apply. |
| `nolib` | The component this patch applies to is not installed on this machine, so there is nothing to patch. |
Example output of "`cplp list`":
>
> ```
> [Expert@MyGateway:0]# cplp list
> ID(PATCH:PROC) STATUS MODE PIDS INSTALLED COMMENT
> --------------------------------------------------------------------------
> cpca:cpca armed livepatch 1/1 2026-08-11 14:09:25 sk185152
> cpm:fwm armed livepatch 1/1 2026-08-11 14:09:33 sk185152 sk185169
> sic:cpd armed livepatch 1/1 2026-08-11 14:09:40 sk185152
> sic:msgd armed livepatch 1/1 2026-08-11 14:09:40 sk185152
> vpn1:iked ready livepatch 0/0 2026-08-11 14:07:19
> vpn1:vpnd ready livepatch 0/0 2026-08-11 14:07:19
> ```
Frequently Asked Questions {#FAQ}
---------------------------------
Click Here to Show the Entire FAQ
* What is CPLP?
> Check Point Live Patch (CPLP) is an in-memory fix designed to protect customers immediately against a critical vulnerability. CPLP detaches the process after the JHF with the fix is applied.
* Does CPLP replace the need to install a Jumbo Hotfix?
> No. JHFs remain the recommended long-term remediation option, as they contain additional fixes that CPLP does not deliver.
* Is CPLP cumulative across multiple CVEs?
> Yes. CPLP is cumulative and can protect against multiple CVEs.
* Does CPLP require downtime or a reboot?
> No. CPLP operates at runtime and does not require downtime or a reboot.
* What does "armed" mean?
> See the CLI Syntax Status table.
* What does "ready" mean?
> See the CLI Syntax Status table.
* Why do some CPLP entries show 0/0 and remain "ready"?
> This indicates that the target process is not running on that system. If the process starts later, the patch arms itself automatically.
* How do I understand a specific flow that is protected by CPLP?
> CPLP is the engine that deploys fixes. For a specific flow, see the relevant CVE SK.
* How can customers monitor CPLP status today?
> CPLP generates audit logs. Customers can also see the status in HCP (Health Check Point). Customers can build alerts using Playblocks, Teams, Slack, email, ServiceNow integrations, or custom log-monitoring solutions.
* Will SmartConsole eventually show CPLP status?
> Yes. CPLP visibility in SmartConsole is planned. Today, visibility is available through Hardening Reports.
* Can the Security Management Server distribute CPLP updates to Security Gateways?
> This is currently not supported. Offline central deployment is on the Check Point roadmap.
List of Patches Installed by CPLP and Resolved Issues {#Resolved Issues}
------------------------------------------------------------------------
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ID | Description |
| Patch 6 - Take 30 - 14 Oct 2026 ||
| ODU-4945, ODU-4966, ODU-4952, ODU-4959 | Enhanced infrastructure capabilities. |
| Patch 5 - Take 28 and Take 29 - 16 Sep 2026 ||
| ODU-4875, ODU-4868, ODU-4861, ODU-4854 | * CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Servers. Refer to [sk1000155](https://support.checkpoint.com/results/sk/sk1000155). * Added support for R82.20 |
| Patch 4 - Take 26 - 14 Sep 2026 ||
| ODU-4812, ODU-4798, ODU-4805 | * Update for CVE-2026-85102 - Enhanced coverage addressing rare scenarios for: * R82.10 Jumbo Hotfix Accumulator Take 24 (or lower) * R82 Jumbo Hotfix Accumulator Take 107 (or lower) * R81.20 Jumbo Hotfix Accumulator Take 146 (or lower) |
| Patch 3 - Take 24 - 09 Sep 2026 ||
| ODU-4756, ODU-4763, ODU-4770 | * CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN. Refer to [sk1000117](https://support.checkpoint.com/results/sk/sk1000117). * CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution. Refer to [sk1000118](https://support.checkpoint.com/results/sk/sk1000118). * Enhancements: * CLI modification * Audit log support |
| Patch 2 - Takes 17 and 18 - 26 Jul 2026 ||
| ODU-4542, ODU-4549, ODU-4556 | * CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to [sk185169](https://support.checkpoint.com/results/sk/sk185169). * CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to [sk185152](https://support.checkpoint.com/results/sk/sk185152). * Enhancements: * Deployment of Management servers is now supported. * Improved output of `"cplp list"` commands. |
| Patch 1 - Takes 9 and 10 - 08 Jul 2026 ||
| ODU-4288, ODU-4302, ODU-4295 | * Initial release of Check Point Live Patch (CPLP) * CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to [sk185033](https://support.checkpoint.com/results/sk/sk185033). |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content