Remote APs in the field should get their update from the controller, so your outage schedule should account for that. Once upgraded, the RAPs will be at the same version as the controller and the vulnerability will be patched.
So just upgrade your controller, and any RAPs will upgrade when the controller reboots and then they will reboot again.