CVSS

CVSS, the Common Vulnerability Scoring System, turns the technical features of a flaw into a number. It asks things like whether the flaw can be used over a network, whether the attacker needs an account first, and how much damage a successful attack does. The result is the score beside most flaws in a scanner's report.

The score is a fair description of the flaw. It was never meant to be a queue on its own. The published number is the same for every organisation and stays the same from year to year, so it can't reflect your network or this week's attacks.

That gap has grown with AI. More flaws are being found, so there are more scored flaws than any team can clear, while only a small share of flaws are ever seen used. Sorting by score spends effort on flaws nobody is attacking. Use the score to order what is left after you have dealt with what is exposed and known to be exploited.