CVSS severity scores often mislead vulnerability prioritization when business context is ignored, leaving critical exposures unresolved.