A critical vulnerability is disclosed on a Tuesday morning. By the afternoon, exploit code is circulating. The security team's scanner reports the affected library on 4,000 assets, the patch requires a maintenance window, and the ticket queue already