Critical dependency CVE

At 14:00 a critical CVE (CVSS 9.8, unauthenticated RCE) is published against a popular serialization library. Your dependency dashboard / SBOM scan flags that 14 of your services pin a vulnerable version of it, including the public-facing API gateway and the payments service. There's a proof-of-concept exploit already circulating on social media. No incident yet, but the clock is running. You're the on-call engineer who caught the page. How do you triage, prioritize, and remediate?