WordPress says to update immediately. Sites with automatic background updates will get it on their own. Fixes in 7.1.4:

• A weakness in the upgrade process that can lead to remote code execution during the upgrade window (reported by Umut Bayram).
• Stored XSS via crafted block markup, Privacy Data Removal Requests, the Interactivity API (several independent reports), Customizer selective refresh, the Categories, Playlist and image blocks, the comments-pagination blocks, and crafted user logins. Anthropic is credited for the privacy-request and user-login bugs.
• A stored denial of service in the Interactivity API, unpublished customizer changesets discoverable by unauthenticated users, and notes readable by privileged users who cannot edit the post.
• Updated bundled root certificates after the eMudhra revocation.

Security fixes are being backported to every branch back to 4.7 and will ship as they are ready; only the latest version is actively supported. 7.2 Beta 3 carries the same fixes. What to do: confirm sites are on 7.1.4 rather than assuming auto-update ran, and check that managed hosts have rolled it out.