CVSS is really just used to stack-rank issues and decide how to handle them. Orgs get a list of CVEs, they sort them by score to decide which ones to handle fir

CVSS is really just used to stack-rank issues and decide how to handle them. Orgs get a list of CVEs, they sort them by score to decide which ones to handle first. From there someone removed from the actual process comes up with deadlines such as "All critical issues, defined as 9.0 or above, must be handled in 30 days." If they are reasonable there is additional language around "or best efforts must be made to resolve or mitigate the issue." If not, gghfdd. On a side note, CVSS v4.0 arrived around 2023-01 and is.. maybe(?) better: https://www.first.org/cvss/v4-0/ https://www.first.org/cvss/v4-0/