Security teams sort vulnerabilities by CVSS base score and treat a high score as high risk. FIRST, which owns CVSS, says that isn't what the score is for: its guidance for both current versions says the base score measures worst-case technical severity and should not be used alone to assess risk. I wanted to see what the score does in practice rather than in principle.
I took 380,164 records from the US National Vulnerability Database and checked which appear on CISA's list of vulnerabilities known to have been exploited. The scores bunch up badly: one score, 9.8, is given to about one vulnerability in seven, and five scores cover more than half of everything scored. They do help, just not enough to rank work on their own. An exploited vulnerability is about 2.4 times as likely at Critical as average, but the top fifth by score holds only 45% of the exploited ones. Assessors also disagree with each other: where the database and a second assessor both score a vulnerability, they land in different severity bands about a third of the time.
Two things I'd be straight about. This is an association, not a prediction, and 228 of the 1,728 listed vulnerabilities were already on the exploited list on or before the day the database published them, though excluding those 228 doesn't change the result. And CVSS v4.0 did better, passing both of my tests, but it rests on only 96 exploited vulnerabilities, mostly from the last two years, and older-version scores also did much better on those same ones, which points at something about the recent data rather than the new version.
So for the versions covering most records, a base score is a coarse sort rather than a priority order, and v4.0 may change that as more data arrives. That isn't a finding that CVSS is useless. The score carries real information and works best as one input alongside evidence of exploitation and knowledge of your own systems.