Multiple High/Critical Alert Detected via Port 18264 | Possible FP

Muhammad_Fitri — Fri, 16 Jan 2026 04:13:52 GMT

I would like to seek a verification and clarification regarding a threat detection observed on our Palo Alto firewall, which we believe may be a false positive.

During our review of the threat log, we noticed that the detection from below source and destination via port 18264 references several filenames as win.ini, fake.cgi, note.txt, jhjr60x8.kspx. These filenames do not appear to relevant in the context of the environment, as the traffic was observed between Check Point devices communicating with each other over TCP port 18264, which is believed to be used for Check Point proprietary internal services (e.g. update, synchronization, or certificate-related communication). Upon further review on the traffic under application found “incomplete”, “checkpoint-cpd” and “web-browsing”.

Re: Multiple High/Critical Alert Detected via Port 18264 | Possible FP

kiwi — Fri, 16 Jan 2026 14:44:53 GMT

Hi @Muhammad_Fitri ,

Similar discussion here:
https://live.paloaltonetworks.com/t5/general-topics/multiple-high-critical-alert-detected-via-port-18264-possible-fp/td-p/1245780

Check the PCAPs if you enabled it in the threat logs. The detected filenames likely mirror patterns in Check Point’s proprietary binary traffic that the Palo Alto firewall is misinterpreting as threats.

Kind regards,

-Kim.

topic Multiple High/Critical Alert Detected via Port 18264 | Possible FP in VirusTotal

Multiple High/Critical Alert Detected via Port 18264 | Possible FP

Re: Multiple High/Critical Alert Detected via Port 18264 | Possible FP