Octet

Say this first

Every change on a VTP server raises the configuration revision. A switch accepts any advertisement with the same domain name and password and a higher revision, and replaces its whole VLAN database with it. Plug in an old lab switch with the same domain and a higher revision, and its VLAN list, often missing most production VLANs, overwrites the domain. Ports in deleted VLANs go inactive everywhere. Prevent it by resetting the revision before connecting any switch, or by running transparent, off or VTPv3.

Go deeper

How it unfolds

A switch comes back from the lab or an RMA. It still has domain CORP, the same password, and revision 41 from months of lab changes. Production is at revision 12.
Someone plugs it into a free port. Both sides are dynamic, so DTP forms a trunk on its own.
The lab switch advertises revision 41. Every switch in CORP accepts it and replaces its VLAN list.
VLANs that only existed in production vanish. Access ports in them show as inactive, SVIs go down, trunks stop carrying them. The whole site loses those VLANs at once.

Check before connecting

Output

SW9# show vtp status | include Mode|Domain|Revision
VTP Domain Name                 : CORP
VTP Pruning Mode                : Disabled
VTP Operating Mode                : Server
Configuration Revision            : 41

Reset the revision to 0

Change the domain to a dummy name and back, or switch to transparent and back:

Cisco IOS

SW9(config)# vtp mode transparent
SW9(config)# vtp mode client

Recovery if it already happened

Disconnect the culprit first. Recreate the missing VLANs on a real server; the revision rises again and every switch learns them back. Ports return as soon as their VLAN exists. Keep VLAN lists in backups or a source of truth so you can rebuild names quickly.

Prevention

Transparent or off mode everywhere, or VTPv3 with a primary server, plus switchport mode access and nonegotiate so a stray switch cannot form a trunk in the first place.

They will ask next

Why does client mode on the newcomer not protect you?
In VTP versions 1 and 2, clients advertise too, and a higher revision from a client wins just like one from a server. Only the revision and the domain and password matter.
Would the VTP password have stopped it?
Only if the lab switch had a different password. Switches configured from the same template usually share it.

Traps

Believing a brand-new switch is the risk. A factory-fresh switch has revision 0 and no domain; reused switches are the danger.

How did you do?