Emergency patching

Some flaws justify skipping normal change control, and the skip has to be a decision somebody made rather than a habit.

Actively exploited, internet-facing and critical is a reasonable bar. The risk is that emergency becomes the routine path because it is faster, at which point the organisation has no change control, just a process it bypasses. The bypass needs to be exceptional, recorded and reviewed afterwards.