Context
Critical CVSS scores are a signal, not a complete prioritization. The key question is whether a system is exposed, whether usable exploits exist, which privileges are required and whether compensating controls already reduce the risk.
Good triage separates immediate emergency actions from planned remediation work.