#vulnerability-prioritization

Analysis · Jun 3, 2026 · Colten Anderson

Everything is critical, so nothing is critical

A third of last year's CVEs were rated High or Critical, but only a few percent ever get exploited. The severity score was never a risk score, and the queue that treats it like one is the reason confirmed-exploited bugs sit unpatched for 43 days.