Patch fail led to password leak of 900 VPN enterprise servers