Is my company exposed to a significant flaw until the certificate is fixed?
Maybe, maybe not.
If the certificate is actually the intended one than it is a usability nuisance which can lead to security problems in the long run: users are expected to understand this error and check that the certificate is actually the intended ones by comparing the fingerprint or other attributes, which is bad usability. Or users are just trained to skip such warnings, which they will then do an later occasions too even if the certificate is not the expected one - and which would then be a security problem like a MITM attack.
If the certificate is not the intended one, than making users accept it anyway leads to a successful MITM attack, which is definitely a security problem.
So it should better be fixed. How urgent the fix is depends on factors like amount of VPN users affected and the technical knowledge of these users, i.e. if they understand the implications and can properly deal with it or if they simply ignore any warnings.
... note that we do not own/operate the VPN directly (it is operated by a third party).
If the problem is on their end (and not due to misconfiguration on your side) you might question, how much trust you have in the competence of this third party to keep your network secure.