From e.g. https://groups.google.com/d/msg/help-cfengine/9RvHA000ID8/vRKYcl3T1FwJ there is now an el7 RPM, presumably (I did not find this clearly stated anywhere) to deal with systemd in RHEL7/etc.
When upgrading using the normal RPM, on RHEL6 or earlier also for RHEL7, the postinstall script clearly runs e.g. /sbin/service cfengine3 restart.
Now when upgrading to the .el7 RPM no such service restart is done, i.e. after the upgrade the cf-execd, cf-serverd, cf-monitor processes have not been restarted so the system is still running the old, pre-upgrade, version.
Not sure if this is intentional (again, couldn't find any docs, bugs, discussions on it) but it does appear broken.
1. Start with a RHEL7 system running 3.6.4 (rpm: cfengine-community-3.6.4-1.x86_64.rpm)
2. rpm -Uvh cfengine-community-3.6.5-1.el7.x86_64.rpm
3. Run e.g. 'ps auxw | grep cf-' and note the 3.6.4 processes still running