Check you haven’t got a John Sim in your local ACL as an Admin. If yes, check the logs to make sure they haven’t logged in and patch!
You did have auto update on, yeah ???
I assume you are talking about the security patches from several months ago?
This exploit worked on unpatched systems with exposed management interfaces (which is off by default)
Yup my error, didn’t realise it was about the last vulnerability