A 14-day window between exploitation and Oracle's advisory left insurers and regulators with no patch and no warning ...