An extensible commercial software system was upgraded to the next minor release version to patch a security vulnerability. After the upgrade, an unauthorized intrusion into the system was detected…

IDS signature updates are a separate operational task and would not cause an intrusion by themselves - they relate to detection, not the exploited vulnerability.

Custom code written by the company to extend the platform is not maintained by the software vendor and would not be included in the vendor's patch, leaving any vulnerabilities in that code intact.

A minor version patch reverting the system to HTTP is not a documented or expected side effect and is not supported by the scenario.

Cryptographic signing of the patch verifies authenticity but has no bearing on whether extensible components outside the core were addressed.

Using the wrong patch version would be identified by the vendor during troubleshooting; the vendor confirmed core components were updated correctly.

Third-party plug-ins are developed independently of the core product and are not updated when the vendor releases a patch, meaning any security flaws in those plug-ins remain exploitable after the core upgrade.