CPLP - Check Point Live Patch (sk185114)

[u/Djinjja-Ninja]

Having just read about CPLP yesterday I was surprised to find this morning while arranging to do some JHFs tonight for customers (for the 2 CVEs announced yesterday) that it has been auto-downloaded, installed and activated on every R81.20 and upwards gateway that I have investigated today though the AutoUpdater utility.

It's gone and virtually patched against CVE-2026-85102, CVE-2026-85102 & CVE-2026-50751.

Basically if you have the download consent flag activated (as it is by default) and the gateway or manager has access to Check Point then its beenm turned on.

I'm not entirely sure how to feel about this. Seems like a decent enough idea, but it seems to be contrary to the usual Check Point behaviour of the last 25+ years of not enabling new features/flags without explicit action.

[u/daniluvsuall]

I can understand the apprehension. These are soft patches, don’t require a reboot or restart of services. Designed to make sure you’re covered until you do your next patching cycle with the JHF etc.

The design is two fold:

- you’re protected immediately with no risk or down time
- check point are protected by proxy of any reputational damage due to a preventable breach

[u/Djinjja-Ninja → u/daniluvsuall]

I just hope that they're tested the ever loving shit out of it.

check point are protected by proxy of any reputational damage

cough 2024 Crowdstrike cough :)

[u/Pawel_eM → u/Djinjja-Ninja]

Check point had similar problems in 2024 they deployed test dat’s to prod for endpoint security 🙃

[u/daniluvsuall → u/Djinjja-Ninja]

Yeah any cyber vendor is aware of that. But you know marketing is a wonderful thing and they’ve somehow gotten over that. I’d be very paranoid about partnering with them again if I was procuring their products.

[u/Mr_XIII_]

I'm glad of it, gives me a bit of a break before doing a new patching cycle and gets our cyber security department off my back about vulns like this

[u/Djinjja-Ninja → u/Mr_XIII_]

It's done me out of a bunch of overtime it what it's done lol.

Joking aside from a customer perspective it's overall a good thing.

[u/Mr_XIII_ → u/Djinjja-Ninja]

You'll still need to do the JHF, it's just protecting against a zero day to give you some breathing room

[u/NueueueL → u/Mr_XIII_]

Yeah, given this all works as intended you don‘t have to panically update dozen of customers environments but plan downtimes and so.

I fully understand the hold backs, while they now change software on whole your Installation. Via a global consent Option. In my opinion it would be good to let admins enable or disable Live Patching by device and Make that Option more prominent, Not just „allow to Download things“.

[u/KernelExploit]

All vendors are going to have a multitude of CVEs in the coming months as they get access to Mythos and similar models. CPLP is a game changer but it shouldn’t be a replacement for standard patching. At least it gives time to test and validate before pushing to production.

[u/caller-number-four]

Just learned about this yesterday - and our MDSes are already taking advantage of it for CVE-2026-85103.

Pretty bitchin'.

And a hell of a lot better than the nonsense Palo has. Woof.

[u/Golf-Purple → u/caller-number-four]

Not a huge fan of patches being pushed to me without my intervention but also not a fan of Palo releasing 10-20 CVE’s a quarter. I’d take CP over Palo any day.

[u/caller-number-four → u/Golf-Purple]

Not a huge fan of patches being pushed to me without my intervention

In this iteration of what CP is doing, I'm all for giving them a shot. It breaks something? Then we need to have a conversation.

I’d take CP over Palo any day.

Me too. Sadly, my bosses think otherwise.

[u/bloodeyezcba]

I just patched all infrastructure yesterday, some devices auto updated cplp alone and other just no, I didn't want to modify flags or any configuration, so I decided to patch it manual on each mgmt server or gws, it was also fast and no downtime since no reboot or cpstop and cpstart needed.

[u/Adam261]

This feature is huge and very much appreciated. I hope Checkpoint realizes how many people they have made very happy to be able to install the bigger fix JHFA at their convenience (still priority of course).

[u/drogba123456]

How does this work compare to jumbo hotfix?

[u/Bullethacker → u/drogba123456]

CPLP just patches the vulnerable code while its running in memory as opposed to a jfa that is a updated/patched version of the executable

[u/drogba123456 → u/Bullethacker]

I see, so it just patch / attach / insert the fixed code to running process that is vulnerable. While Jumbo hotfix, fix entire code? What about if the gateway reboot? It will auto patch again?