That's why I mentioned vendors. They patch it before announcements.

Also, sandboxing makes automatic exploitation harder. There is no FS persistence, so some checks simply do not pass.