Skip to content
Patcharo

Guides

Choosing a Check Point release and Take for your deployment

How to decide between staying on your release with a newer Take and moving to the recommended release, with the management server, the appliances, the fixes you need and the support dates as the deciding constraints.

Who it is for
Engineers who maintain Check Point gateways and management servers and plan Jumbo Hotfix installations or release upgrades.
Scope
Gaia-based gateways and management servers. Quantum Spark appliances, Harmony and CloudGuard follow their own release model.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

Two different moves: a newer Take, or another release

On a Check Point deployment, keeping current is two different operations. Installing a newer Take of the Jumbo Hotfix Accumulator keeps the release and brings the fixes published since the installed Take; it is the routine move. Upgrading to another release (from one major release to the next) changes the software base, needs an upgrade path and a maintenance window of another size; it is the move the recommended version of sk95746 is about.

The first question is therefore which move the situation calls for. A device on a supported release that lacks the Take fixing a vulnerability needs a Take. A device on a release near its end of support, or on a release whose accumulator will never carry the fix for a vulnerability the vendor fixed elsewhere, needs a release change.

What to collect before deciding

  • The release and Take of every gateway and of the management server, as their installed packages report them.
  • The appliance models and their support dates in the Support Life Cycle Policy: an appliance past its end of support may not run a newer release.
  • The advisories that concern the devices, with the Take or hotfix each SK names for your release.
  • The recommended version of sk95746 and, for your release, the latest Take of its accumulator with its adoption level.
  • The known limitations the accumulator's documentation lists for the Takes you consider.

Management first, then the gateways

The Security Management Server manages gateways of its own release and of earlier releases, not of later ones: a gateway cannot be moved to a release newer than its management server's. A release upgrade therefore starts with the management server, then its SmartConsole, then the gateways. Within a release, the accumulator documentation states for each Take whether it applies to management, gateways or both, and whether a matching SmartConsole build exists; read the Take's entry before planning the order.

A multi-domain deployment, a VSX environment or a cluster has its own instructions in the upgrade documentation of the target release; the general rule above does not replace them.

A method in five steps

  1. For each device, list the first fixed Take of every advisory that concerns it on its release; the highest is the floor on that release. If an advisory has no fix on your release, the floor is a release change.
  2. Compare the floor with the latest Take of the release: when the latest Take is at or above the floor, installing it is the routine move. Under the vendor's current policy that Take is also the recommended one; its adoption level tells you how widely it has been deployed.
  3. Read the recommended version of sk95746: a deployment far from it, or on a release approaching its end of support, plans a release upgrade rather than another round of Takes.
  4. Check the appliances against the Support Life Cycle Policy and the target release's supported hardware: an appliance that does not run the target blocks the whole plan or splits it in two.
  5. Order the operations: management server, SmartConsole, then the gateways, cluster members one at a time, with the Take's own instructions from its entry and the FAQ.

Verifying and recording

After the installation, record the Take each device reports, not the one you intended: a Take that failed to install or was rolled back leaves the device at its previous Take. The matching then shows which advisories remain, and the current Take of the release tells you when the next routine move is due.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

Quantum Security Gateway

Product page

Recommended release for all deployments: R82.10

  • R82.20Latest public release —Vendor recommendation —Not collected
  • R82.10Latest public release —Vendor recommendation R82.10Not collected
  • R82Latest public release —Vendor recommendation R82 JHF Take 127Not collected
  • R81.20Latest public release —Vendor recommendation R81.20 JHF Take 170Not collected

Quantum Security Management

Product page

Recommended release for all deployments: R82.10

  • R82.20Latest public release —Vendor recommendation —Not collected
  • R82.10Latest public release —Vendor recommendation R82.10Not collected
  • R82Latest public release —Vendor recommendation R82 JHF Take 127Not collected
  • R81.20Latest public release —Vendor recommendation R81.20 JHF Take 170Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

  • Planning a gateway upgrade to a release newer than the management server's.
  • Reading the recommended version of sk95746 as a reason to stop installing Takes on the current release.
  • Installing a Take without reading its known limitations and its SmartConsole requirement.
  • Choosing a target release an appliance of the deployment cannot run.

What to verify before acting

  • The release and Take of every device, management server included.
  • The first fixed Take each advisory names on your release, and whether an advisory names a later release instead.
  • The latest Take of your release, its adoption level and its known limitations in the accumulator's documentation.
  • The appliances' support dates and the hardware the target release supports.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.