For exact answer to your question, any patch/bug fix that is released for any version, is also released for each version that is supported and has the same vulnerability/bug. Meaning, if there is a security vulnerability on 10.15, that same fix will be released for lower versions and higher version too. It also applies to versions that customers have extended support agreement. You can only receive patches for the versions that you have the support agreement. In other terms, if there is a security patch released for example for version 10.3, only those who have extended support agreement will receive the patches that are released after support ended.
#webMethods#Integration-Server-and-ESB