Severity is a rating that helps security teams prioritize software flaws by how urgently they should be addressed. It is usually based on the likely impact of exploitation, such as data exposure, privilege gain, service interruption, or broader system compromise. Higher severity scores or labels, such as critical or high, usually mean a fix should be planned sooner.
In cyber security, severity matters because defenders rarely have enough time to treat every issue equally. Vulnerability management tools, advisories, and ticketing systems use severity to sort work, assign response windows, and decide whether an issue needs emergency patching or can wait for a normal maintenance cycle. However, severity is only a triage signal: it does not prove exploitation, confirm that an attacker can reach the flaw, or account for every environment. A low-severity issue may still be dangerous in the wrong context, while a high-severity issue may be harder to abuse if it is not exposed. Good defense combines severity with asset visibility, reachability, and patch testing.