I wonder how much time discussing if something is or isn’t a CVE has wasted. As and end user if you don’t have a script that causes an exploit for a given CVE

I wonder how much time discussing if something is or isn’t a CVE has wasted. As and end user if you don’t have a script that causes an exploit for a given CVE i don’t care. I have had to patch too many systems from hypothetical issues ASAP!! because management wants to look like they know something