'a high CVSS means patch first'

A high base score means the flaw is serious in the abstract. It does not mean it is your most urgent problem.

A 9.8 on a system nobody can reach, holding nothing, matters less than a 6.1 on the box facing the internet that is being actively exploited this week. Three things reorder the queue: whether it is being used in the wild, whether an attacker can actually reach it in your environment, and what the affected system does. Working strictly down by score is how teams stay busy while remaining exposed.