Why does the same vulnerability get different priority on different assets?
The same CVE ranks differently because asset context—criticality, exposure, dependencies, and environment—changes the decision, not because severity scores are wrong.
Why does the same vulnerability get different priority on different assets?
Short answer
The same vulnerability can warrant different priority because asset context changes the decision—criticality, exposure, dependencies, environment, and reachable impact—not because CVSS is "wrong."
Explanation
Severity scores describe the weakness in isolation. Prioritization asks what that weakness means here: who uses this asset, what it connects to, and what could happen if it is exploited. Identical CVEs on a decommissioned sandbox and a customer-facing API should not share the same urgency.
Guide: Asset Criticality (KID-CON-0082).