Does a high CVSS score predict that a vulnerability will be exploited?

No. A high CVSS score means that the technical consequences and conditions are severe according to the chosen vector. There is not a calibrated probability that the vulnerability will be exploited within a certain period of time. Research shows that prioritizing solely on CVSS thresholds can be ineffective (Jacobs et al., 2020).

CVSS 4.0 can include current exploit maturity in the Threat Metrics. For example, EPSS can be used for a probability estimate; confirmed attacks and proprietary threat information are also relevant. These sources also do not replace local risk assessment.