Skip to content
Patcharo

Guides

Latest, recommended, fixed, end of support: four facts that never mean the same thing

The four words every version decision rests on, what each vendor means by them, how they contradict each other on a real device, and the order in which to read them.

Who it is for
Anyone who decides which release a firewall or a security appliance should run, from the engineer who patches to the manager who approves.
Scope
The four facts as published by Palo Alto Networks, Check Point, Fortinet and Cisco for the products Patcharo covers; the vendor guides give each vendor's details.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

Four questions, four documents

FactThe question it answersWhere it is publishedWhat it does not say
Latest releaseWhat is the newest release of this branch the vendor lists?Release notes, documentation libraries, download pagesWhether you should install it, whether it fixes your vulnerability
Recommended releaseWhat does the vendor advise running, and for whom?A dedicated statement: an article, a release guidance page, a mark on a download pageWhether it fixes your vulnerability, whether it runs on your model
Fixed releaseWhich release first closes this vulnerability on this branch?The security advisory of the vulnerabilityWhether the vendor recommends it, whether it is the newest
End of supportUntil when does this branch receive fixes?The vendor's life cycle policy or end-of-life summaryWhether the branch is affected today
Each fact has its own document and its own date; none can be deduced from another.

A version number alone answers none of the four questions. The newest release is read from a list of what exists; the recommendation is a sentence the vendor writes for a purpose; the fixed release is stated per vulnerability and per branch; the end of support is a date in a policy. Reading one of them as a proxy for another is where most upgrade mistakes start.

What each vendor means

  • Palo Alto Networks: the newest maintenance release of a PAN-OS line is listed in the line's release notes; the vendor's release guidance for customers is published in its support portal, which Patcharo does not read, so Patcharo shows no PAN-OS recommendation; fixed releases are stated per line in the advisories, hotfix suffixes included; the End-of-Life Summary dates each line.
  • Check Point: the newest Take of a release's Jumbo Hotfix Accumulator is listed in that release's documentation; sk95746 names the recommended version for all deployments and the policy that makes each new Take recommended from its release; fixed Takes are named by the vulnerability's SK article and the Take's resolved issues; the Support Life Cycle Policy dates each release.
  • Fortinet: the Document Library lists the releases of each branch; the vendor labels releases Feature or Mature and publishes a recommended release per model; FortiGuard PSIRT advisories state the fixed releases per branch; the product life cycle gives the end of engineering support and the end of support of each branch.
  • Cisco: the release notes of each train list its releases and dates; the vendor marks suggested releases in its Software Download portal (sign-in), which Patcharo does not read, so Patcharo shows no Cisco recommendation; advisories state first fixed releases per train; end-of-sale and end-of-life bulletins date the trains.

Where a vendor publishes its recommendation only behind a sign-in, Patcharo says so instead of guessing: the newest release is never promoted to recommended because no other statement exists.

How the four facts contradict each other on a real device

  • Recommended but affected: the vendor's recommended release is older than the first fixed release of a vulnerability that concerns the device. The device must move above the recommended release, or wait for a hotfix on it.
  • Latest but not recommended: the newest release of the branch is out, the vendor has not changed its recommendation. Running it is a choice, with its known issues, not a requirement.
  • Fixed but unsupported: the branch received its last fix and reached its end of support; the next vulnerability will have no fixed release on it. The question is no longer which release, but which branch.
  • Supported but never fixed: a vulnerability has no fixed release on a branch the vendor still supports, with a workaround or a migration stated instead. Patcharo shows the vendor's statement, never an invented release.

A reading order that leads to a decision

  1. Start from the device: its exact version, its branch, its model.
  2. Read the fixed releases of the vulnerabilities that concern it; the newest of them is your floor on this branch.
  3. Read the end of support of the branch: if it is near or past, the decision becomes a branch change, and the floor moves to the target branch.
  4. Read the vendor's recommendation for your model or deployment; prefer it when it is at or above the floor, state why when it is below.
  5. Read the newest release only as the upper bound of what exists, with its known issues.
  6. Verify the constraints of the vendor guide for your product: compatibility, management server, upgrade path.

How Patcharo keeps the four facts apart

Patcharo reads each fact from the vendor's document that states it, about every six hours for the release catalogs and the recommendations, and shows them on separate lines with their source and the day they were verified. A fixed release comes only from the advisory; a recommendation only from the vendor's statement; the newest release only from the vendor's list; the support date only from the life cycle policy. A value that cannot be read is shown as unknown or not published, never replaced by the nearest number.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

PAN-OS

Product page
  • 12.2Latest public release —Vendor recommendation —Not collected
  • 12.1Latest public release —Vendor recommendation —Not collected
  • 11.2Latest public release —Vendor recommendation —Not collected
  • 11.1Latest public release —Vendor recommendation —Not collected

Quantum Security Gateway

Product page

Recommended release for all deployments: R82.10

  • R82.20Latest public release —Vendor recommendation —Not collected
  • R82.10Latest public release —Vendor recommendation R82.10Not collected
  • R82Latest public release —Vendor recommendation R82 JHF Take 127Not collected
  • R81.20Latest public release —Vendor recommendation R81.20 JHF Take 170Not collected

FortiOS

Product page
  • 8.0Latest public release —Vendor recommendation —Not collected
  • 7.6Latest public release —Vendor recommendation 7.6.6Not collected
  • 7.4Latest public release —Vendor recommendation 7.4.11Not collected

Secure Firewall Threat Defense (FTD)

Product page
  • 7.7Latest public release —Vendor recommendation —Not collected
  • 7.3Latest public release —Vendor recommendation —Not collected
  • 7.2Latest public release —Vendor recommendation —Not collected
  • 7.0Latest public release —Vendor recommendation —Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

  • Reading the newest release as the recommended one, or the recommended one as fixed.
  • Deciding on a branch past its end of support as if a fix would come.
  • Dropping a hotfix suffix or a Take number, which is the part of the version the fix is stated on.
  • Trusting a download page's mark remembered from months ago as the current recommendation.

What to verify before acting

  • The exact version of the device and its branch, as the device reports them.
  • The first fixed release the advisory names for that branch.
  • The support dates of the branch in the vendor's life cycle policy.
  • The vendor's recommendation statement and its date, from the document that states it.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.