Everything is a critical CVE now, which means nothing is

Counted them this morning out of morbid curiosity: eleven “critical” CVEs crossed my feeds this week. Eleven. Scored 9-point-something, “patch immediately,” the whole liturgy. I checked three of them properly. One needed local root access and physical presence at the console to exploit, which is a threat model I believe we used to call “someone’s already in your house.”

This isn’t a rant about any single vendor’s PR team overselling a bug to get ahead of the news cycle, though sure, that happens too. It’s about the scoring system itself quietly losing all signal value, one inflated CVSS number at a time.

How you get here

CVSS was built to be objective — attack vector, complexity, privileges required, user interaction, scope, the whole vector string. In practice, the incentive on every side points toward a higher number:

• Researchers get more attention for a 9.8 than a 5.4, and attention is currency now.
• Vendors would rather announce “we patched a critical vuln fast” than “we found a moderate issue eventually” — the first sounds responsible, the second sounds like you shipped garbage.
• Compliance tooling treats the number as gospel and auto-generates tickets off it, so a high score creates organizational motion regardless of actual exploitability.

Every one of those incentives is individually reasonable. Stacked together they produce a scoring system where “critical” has been diluted into “notable.”

What I actually do with a CVE now

I stopped reading the headline score somewhere around 2019 and started reading the vector string first, every time, no exceptions. AV:N/AC:L/PR:N/UI:N gets my attention immediately — unauthenticated, network-reachable, no user interaction required, that’s a real fire. AV:L/AC:H/PR:H with a 9-point score gets filed and read later, because whatever produced that number, it isn’t urgency.

The other thing I do, and this is the part that’ll actually save you time: check whether the vulnerable code path is even reachable in your deployment. A critical RCE in a library feature you don’t use, behind a config flag you don’t set, compiled out of the binary you actually ship — is not your incident. It’s a line item for the next dependency bump, not a 2am page.

Score inflation isn’t going to fix itself. Nobody benefits from fixing it. So the job falls to whoever’s triaging the alert, same as it always has: read past the number, model the actual attack path, and reserve your panic for the CVEs that have earned it.