How quickly should I patch a critical vulnerability?

Question

Accepted Answer

Patch anything with confirmed in-the-wild exploitation on internet-facing systems within days, not weeks — CISA KEV deadlines for US federal agencies are typically two to three weeks and are treated as a ceiling, not a target. Everything else belongs on a risk-ranked cycle driven by exposure and exploitation probability rather than severity score alone.

A single universal SLA does not survive contact with reality. The useful version is tiered: exploited and exposed gets emergency handling, exploited but not reachable gets the next scheduled window, and unexploited gets normal maintenance.

The constraint is rarely knowledge — it is change control, testing, and downtime windows. Teams that patch quickly have usually invested in the ability to deploy safely, not in better vulnerability feeds.

Where you genuinely cannot patch in time, compensating controls buy real time: restricting network reachability, disabling the affected feature, adding detection for known exploit behaviour, or increasing monitoring on the exposed asset.