If a Commercial CA believe they are compromised they will revoke the sub-CAs that they believe are affected. This does not mean that all software that trusts that CA will automatically distrust the compromised CA.
Browsers for example should check a certificate revocation list (CRL) before trusting a certificate chain. However, these checks are notoriously done incorrectly or don't exist at all. They do however generally update their trusted certificates store with an update to the browser. Other commercial software that trusts a certificate that is compromised must update their trusted stores as well. It's up to the software to keep up with known compromises of certificates and certificate authorities.
I'm not entirely sure what you mean by "Commercial Certificate Issuing software". But I'm sure that CAs like Symantec (Verisign), Comodo, and Go Daddy all provide some mechanism for revoking their certificates. However, it is up to the software that trusts the certificate to make sure that those certificate revocations get implemented in some way. Either by using up-to-date CRLs, or by providing updates to the software to remove un-trusted certificates.