Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead)

This report argues that CVSS-first vulnerability prioritization is ineffective and misaligned with attacker behavior, presenting evidence that only a small fraction of high-CVSS vulnerabilities are actually exploited and that many exploited issues carry medium CVSS scores; it documents structural changes at the NVD, recommends a triaged model using CISA KEV, EPSS, and threat actor intelligence to reduce urgent queues and focus remediation on vulnerabilities actively weaponized in the wild.