Since not all vulnerabilities in priority systems can be fixed, assess each one's impact on own services and systems including the likelihood of exploitation, not only the CVSS score and exploit availability (low-scoring vulnerabilities are increasingly exploited and exploits can appear immediately), and fix higher-risk ones first promptly and thoroughly; consider narrowing pre-patch testing reasonably after weighing failure risk from insufficient testing against attack risk from unpatched systems.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.