> Source: [sk185114](https://support.checkpoint.com/results/sk/sk185114)

# sk185114 - Check Point Live Patch (CPLP)

| Property | Value |
|----------|-------|
| Solution ID | sk185114 |
| Date Created | 2026-07-01 |
| Last Modified | 2026-08-18 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.10, R82.10, R82, R81.20, R81.20, R82 |
| OS | Gaia |

## Solution

**Introduction \| Online Installation and Updates \| Supported Configurations \| Known Limitations
Availability \| CLI Syntax \| List of Patches Installed by CPLP and Resolved Issues**

Introduction {#Introduction}
----------------------------

**Check Point Live Patch (CPLP)** is a built-in mitigation-delivery service included with the Gaia operating system. It closes critical vulnerabilities in the field by applying targeted, in-memory fixes (Live Patches) to already-running Check Point processes, without restarting the process and without rebooting the Gaia server, so protection is in place immediately.

CPLP helps decrease the time-to-protection for critical issues and lets you decide when to install the permanent Hotfix or Jumbo Hotfix Accumulator during a planned maintenance window.  

CPLP itself carries no fixes. It receives, validates, and safely applies the individual Live Patches delivered to it. Each Live Patch is a dedicated Check Point security package. CPLP runs quietly in the background as a managed service and acts as the "ready table" for Live Patches: as patches arrive, CPLP holds them and applies each one only when it is safe to do so.

* **Background service** - No manual action is required, if a patched process restarts or the Security Gateway reboots, CPLP re-applies active Live Patches automatically.
* **Safe-condition gating** - A Live Patch is applied only when CPLP can positively confirm it is safe to attach to the target process and that the patch matches the running software. Otherwise, the target process is left untouched.
* **Automatic stand-down** - When the matching Hotfix or Jumbo Hotfix Accumulator containing the fix is installed, CPLP recognizes a fix is present and stops applying the patch.
* **Fail-Open**- CPLP monitors the health of patched processes. If a patched process crashes repeatedly, CPLP automatically disables itself, reverts the change, and stops re-applying the patch.

CPLP is a **temporary mitigation** and does not replace the official deployment flow. It bridges the gap until the corresponding Hotfix or Jumbo Hotfix Accumulator is installed during a planned maintenance window. After a complete hotfix package is installed, CPLP automatically steps aside.

### Online Installation and Updates {#Installation}

When Automatic Update downloads are enabled on the Gaia server (see [sk175504](https://support.checkpoint.com/results/sk/sk175504), section 2-B), CPLP is installed and kept up-to-date automatically on all Check Point servers that CPLP supports. No manual action is required. Applicable Live Patches are delivered in the same way.

If Automatic Updates are disabled on the Security Gateway, or the Security Gateway has no Internet access, [contact the Check Point Support](https://www.checkpoint.com/support-services/contact-support/) for assistance with manual installation of the required packages. Check Point recommends keeping Automatic Updates enabled, so that critical-issue mitigations reach the Security Gateway promptly.

Supported Configurations {#Supported Configurations}
----------------------------------------------------

CPLP supports these configurations:

* Single Security Gateway.
* ClusterXL Members.
* Single Security Gateway in the Traditional VSX mode.
* ClusterXL Members in the Traditional VSX mode.
* Scalable Platform Security Group in the Gateway mode.
* Scalable Platform Security Group in the Traditional VSX mode.
* Scalable Platform Security Group in the VSNext mode.
* Standalone (Security Gateway and Security Management Server on the same server).
* Security Management Server.
* Multi-Domain Security Management Server / Multi-Domain Log Management Server.

Known Limitations {#Known Limitations}
--------------------------------------

CPLP does not support these configurations:

* Spark Firewall appliances.

Availability {#Availability}
----------------------------

|------------|-------------------------------------------------------------|--------------|
| Version    | Take Number                                                 | Release Date |
| **R82.10** | BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE **take 18** | 28 Jul 2026  |
| **R82**    | BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE **take 17**    | 28 Jul 2026  |
| **R81.20** | BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE **take 18** | 28 Jul 2026  |

CLI Syntax {#CLI Syntax}
------------------------

These commands are available for visibility and manual override.

1. Connect to the command line on the Security Gateway / each ClusterXL member / Security Group.

2. Log in to the Expert mode.

3. Run:

   * On a Security Gateway / ClusterXL member:

     `cplp <option>`
   * On a Scalable Platform Security Group:

     `g_all cplp <option>`

Explanations:

|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Command             | Description                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| `cplp status --all` | Shows the overall CPLP status and the status of applied patches.                                                                                                                                                                                                                                                                                                                                                                                        |
| `cplp list`         | List all Live Patches known to the Security Gateway (in all statuses - armed / unsupp / reverted / ready). * armed - Patch is active and all related processes are patched. * unsupp - Unsupported. The patch is no longer relevant, a newer jumbo or hotfix containing the fix was installed. * reverted - Patch was either manually or automatically reverted due to repeated crashes. * ready - Patch is active, but pending for processes to patch. |

Each installed Live Patch appears with one of these statuses:

|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Status               | Description                                                                                                                                                                     |
| Armed                | Patch is active and applied to the target process.                                                                                                                              |
| No patched processes | Patch is delivered but not yet applied, either the target process has not started yet, or the patch does not match this Gaia server's software version and will not be applied. |
| Reverted             | Patch was previously applied and has been reverted.                                                                                                                             |

Example output - cplp list:
>
> ```
> [Expert@MyGateway:0]# cplp list
> ID(PATCH:PROC)        STATUS     MODE        PIDS    INSTALLED            COMMENT
> --------------------------------------------------------------------------
> cpca:cpca             armed      livepatch   1/1     2026-08-11 14:09:25  sk185152
> cpm:fwm               armed      livepatch   1/1     2026-08-11 14:09:33  sk185152 sk185169
> sic:cpd               armed      livepatch   1/1     2026-08-11 14:09:40  sk185152
> sic:msgd              armed      livepatch   1/1     2026-08-11 14:09:40  sk185152
> vpn1:iked             ready      livepatch   0/0     2026-08-11 14:07:19
> vpn1:vpnd             ready      livepatch   0/0     2026-08-11 14:07:19
> ```

Example output - Processes were patched:
>
> ```
> [Expert@MyGateway:0]# cplp status --all
> ID(PATCH:PROC)        EXEC NAME       PID  PATCHES   STATUS      ACTION-TIME          OBSERVED
> ---------------------------------------------------------------------------------------------------
> cpca:cpca             cpca          16429  1         armed       2026-08-11 14:09:26  1 armed_clean
>  
> ID(PATCH:PROC)        EXEC NAME       PID  PATCHES   STATUS      ACTION-TIME          OBSERVED
> ---------------------------------------------------------------------------------------------------
> cpm:fwm               fwm           11165  10        armed       2026-08-11 14:09:34  10 armed_clean
>  
> ID(PATCH:PROC)        EXEC NAME       PID  PATCHES   STATUS      ACTION-TIME          OBSERVED
> ---------------------------------------------------------------------------------------------------
> sic:msgd              msgd          10981  4         armed       2026-08-11 14:09:40  4 armed_clean
> sic:cpd               cpd           11083  4         armed       2026-08-11 14:09:41  4 armed_clean
> [Expert@MyGateway:0]#
> ```

Example output - Patch is pending for the relevant process to start, or the patch version does not match the server's version:
>
> ```
> [Expert@MyGateway:0]# cplp status --all
> No patched processes, for full list of patches run `cplp list`
> [Expert@MyGateway:0]#
> ```

List of Patches Installed by CPLP and Resolved Issues {#Resolved Issues}
------------------------------------------------------------------------

|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ID                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Patch 2 - Takes 17 and 18 - 26 Jul 2026                                                                                                                                                                                                                                                                                                                                                                                                                                                                     ||
| ODU-4542, ODU-4549, ODU-4556 | * CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to [sk185169](https://support.checkpoint.com/results/sk/sk185169). * CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to [sk185152](https://support.checkpoint.com/results/sk/sk185152). * Enhancements: * Deployment of Management servers is now supported. * Improved output of `"cplp status --all"` and `"cplp list"` commands. |
| Patch 1 - Takes 9 and 10 - 08 Jul 2026                                                                                                                                                                                                                                                                                                                                                                                                                                                                      ||
| ODU-4288, ODU-4302, ODU-4295 | * Initial release of Check Point Live Patch (CPLP) * CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to [sk185033](https://support.checkpoint.com/results/sk/sk185033).                                                                                                                                                                                                                            |

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content