The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

The Protection Profile (PP) is a document that defines security requirements for a class of products and is not product-version-specific; applying a patch to a single product does not require updating the PP.

Common Criteria evaluations are performed against a specific, fixed version of a product (known as the Target of Evaluation or TOE). When a security patch is applied, the TOE changes, meaning the evaluated configuration no longer matches the certified configuration. To regain an official EAL rating, the modified product must go through the CC evaluation and certification process again.

The product cannot simply retain its current EAL rating after modification because the certification was granted to a specific, evaluated version of the product, and any change to that version invalidates the certification.

EAL ratings are not automatically downgraded to a lower level upon modification; rather, the entire certification is invalidated and the product loses its EAL status until recertification is completed.