A critical CVE on an isolated internal system can wait; a medium one on an internet-facing box under active exploitation cannot. Patching by real-world exposure and exploitability beats chasing severity scores down a list.
“Patch what's exposed and exploited, not what scores highest.”