SOC2 CC7.1 [1] requires a vulnerability scanner, findings tracked with tickets, assigned severities according to a documented risk-based system, severity-based SLAs for remediation, and that the SLAs mostly be complied with or have tracked exceptions.

However it doesn't mandate any particular SLA, or the details of how risks are to be evaluated.

Organisations get to write their own policy, and they don't need to commit to patching every CVE within 24 hours or anything like that.

[1] https://www.compliancebase.org/controls/soc-2/cc7-1