Changing firmware for APs on a vSZ is easy, but easily overlooked. Firmware is contained to a Zone. The Domain (parent of Zones) does not have the ability to set firmware. This gives you the control to have multiple firmware versions within a Domain (think school district for Domains and schools for Zones) if needed.
In vSZ 3.5, you can go under the Access Points section on the left hand pane and see a list of the Domains and Zones. Navigate down to the needed Zone and use the “More” button above it (not the More button more to the center of the page) and just select “Change AP Firmware”.
You will then be presented with the options available to select for firmware. Choose the one you want/need and press OK. At that point, all of the APs contained within that AP Zone will start applying the specified firmware.