A score runs from 0 to 10 and is built from measurable traits, such as whether the flaw can be reached over the network, how hard it is to exploit, whether login is needed and what it does to confidentiality, integrity and availability. Scores of 9.0 and above are labelled Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium and 0.1 to 3.9 Low. The standard is maintained by FIRST, and version 4.0 was released in late 2023.
The score describes the flaw in general, not your situation. It does not know whether the system is reachable from the internet, whether attackers are using the flaw or what sits behind it. A medium score on a flaw that is under active attack can matter more than a critical score on a system that nobody can reach.
Log4Shell scored the maximum 10.0, and rightly so. But many serious incidents have started with flaws scored well below that, often as one link in a chain.
Treat CVSS as a starting point, add exploitation evidence and exposure to it, and do not set patch deadlines on the number alone.