Hi Miguel,
That is correct - unfortunately the Enforce console cannot push software updates to the Endpoints - only Config and Policy updates are possible.
A new Agent package will need to be generated from Enforce and deployed using your Desktop management tool (SCCM etc.)
The Updated Enforce and Detection servers should be backwards compatible with the older Agent version, however you will obviously not get any of the benefits of the updated Agent :)
Regards,