How quickly should I patch a critical vulnerability?

For anything internet-facing, treat it as this week’s work rather than this month’s:

• Internet-facing first - website, remote access, firewall, VPN. These are what gets scanned automatically.
• Then everything else - workstations and internal software on the normal update cycle.
• Exploits follow disclosure quickly - the window between a fix being published and it being attacked is often days.

If you cannot patch quickly, the honest alternative is to take the exposed service off the internet until you can.