It's important that each time you install an AEM upgrade (CFP or SP), to check that your customizations are still valid.
If you have changed /libs/sling/xss/config.xml to /apps/sling/xss/config.xml a few versions ago, then in the meantime the original file under /libs may have changed while your customized version under /apps did not. It may be completely out of date!
Here's what you should do:
Identify the changes that were made in the /apps/sling/xss/config.xml file
Create a new overlay from /libs/sling/xss/config.xml to /apps/sling/xss/config.xml
Apply the changes you had made to /apps/sling/xss/config.xml to the new version (if applicable)