CVSS tells you how bad — not whether it can reach you.
CVSS scores measure theoretical severity in the abstract. A 9.8 in a function you never call is a lower real priority than a 6.5 sitting directly in your request path.
CVSSSeverityTypical response
9.0-10.0CriticalFix immediately, often out-of-band
7.0-8.9HighFix within days
4.0-6.9MediumFix within the normal sprint
0.1-3.9LowTrack, fix when convenient
The reachability question
1
CVE found, CVSS 9.8Critical, in a transitive dependency.
2
Is the code path reachable?Never called → lower real priority. Directly reachable → urgent.
IAST combines SAST's visibility with real execution data. RASP blocks attacks live, from inside the running app.
Prioritize by real severity and actual reachability — CVSS alone is not a prioritization strategy.