Exploitability

Exploitability asks a practical question: how likely is it that anybody will actually use this flaw against anybody.

Most published flaws never get used. A small proportion get used widely and quickly. Estimates of likelihood are imperfect and still enormously better than assuming every flaw is equally likely to be exploited, which is what a queue ordered purely by severity implicitly assumes.

Checked against the primary source.

More on Vulnerability management