Patch windows are argued about as though the attacker learns of a flaw when the defender does. Here the advisory was not the starting gun.
The first flaw supplies the authentication the second one requires. A pair of medium problems is not a medium problem.
The patch had existed for two years. The campaign needed no new capability, only servers nobody had looked at.