We have an old Magento 2 installation, roughly a year old. Browsing the magento site it looks like patches are only for 1.x and not 2.x. Is that right? So for the latest fixes I need to upgrade to the latest version of 2.x?
Magento provides the patches for 2.x version:
Note: it's better if we upgrade our Magento source to the newer version.