I've just managed to successfully update our (two) primary servers to ZCM 11.2.3a using ZCM_11.2.3a_Patch_815623 (ZCM 11.2.3a fix for Zone-wide pre-install actions fail on updating Oracle db - see TID 7012196).
After importing the system update I assigned the new 11.2.3a agent to both our primary servers (no satellites) and after that to one test device. Everything went just fine. But when I now look at whatever device in our zone through ZCC I see the update to 11.2.3a assigned! I checked Configuration -> System Updates and found the update with 0 pending, 3 successful and 0 failed, so that's correct. I refreshed the agent on one of our devices several times and fortunately the update process wouldn't start.
But why does ZCC then show the update as assigned to every device in the zone?!