It always depends on the vulnerability, but most major organizations are able to patch critical issues in less than 24 hours. That's the result of improving continuous integration and release engineering pipelines to the extreme.

The real issue is getting 100% of users to download and apply the patches. We haven't solved that one yet.