It means they have a patch - but usually there are still a lot of installations everywhere. when the CVE is published people are only starting to patch their systems