The Patch Existed for Five Months. The Information Needed to Prioritize It Did Not.
When the vendor's severity assessment is wrong, every correct prioritization decision built on it is also wrong. The patch isn't the bottleneck. The classification is.
