Vulnerability Management : Doubts in SLA

How much does your organisation take to fix a critical vulnerability in an operating system package. For example cases like a Privilege escalation vulnerability, it requires initial compromise using some other vulnerability like an RCE in the app layer. Assume you have enough protections in the app layer, how long would you take to fix the vulnerability ?

Would you still comply the SLA or this will be exempted as there's no direct exploitability ?

[View Poll](https://www.reddit.com/poll/13twx96)

app cases compromise critical critical vulnerability cybersecurity escalation fix management operating system organisation package privilege privilege escalation rce sla system vulnerability vulnerability management