## 9 Conclusions
Using automated solutions, as in our previous research, the changes might be introduced dynamically, depending on the change in vulnerability exploitation--especially using CVSS v3.x, including metrics responsible for Exploit Code Maturity (E) and Remediation Level (RL). From our experience, the second parameter should have little influence on prioritization of vulnerability, as the presence of a potential fix should not lower the overall score but might be helpful with mitigation time estimation. CVSS v4.0 takes an interesting approach, consistent with previous observations, to the temporal metric by exchanging it with a threat metric, with only one metric called exploit maturity and treated as separate component in calculations. This approach should allow easier adoption of the threat intelligence process by organizations, as this metric might be the most dynamic with greater influence on the overall score. The main limitations of efficiency gains in the presented approach could be found in the lack of a temporal score metric that would further improve the overview of vulnerabilities expressed in the overall score. Adoption of the Exploit Prediction Scoring System (EPSS) into the vulnerability management process should also provide a clearer picture of vulnerability and improve gains within the prioritization process. Identified edge cases that could not be analyzed using the following methods are identified as critical vulnerabilities with existing exploits--these vulnerabilities should be addressed by the vulnerability management process in the first place. However, it should also be noted that the methodology developed for the implementation of the CVSSv3.x standard also has some limitations. As the major shortcoming of the implemented methodology, we identify the fact that the errors incurred whilst calculating the CVSSx3.x base score propagate down and affect the full CVSSv3.x score that includes the environmental component. Also, it should be noted that the CVSSv3.x standard itself, even if implemented accurately, has some intrinsic limitations, some of which are intended to be addressed with the newly released CVSSv4.0 standard. The newly released CVSS v4.0 [56] standard introduces fundamental paradigm shifts that significantly impact our proposed methodology. The nomenclature evolution replaces temporal metrics with threat metrics including Exploit Maturity (E) and introduces environmental security requirements along with modified base metrics providing finer granularity than v3.x implementations. Supplemental metrics create additional scoring beyond the traditional CIA triad. The increased complexity of CVSS v4.0 creates exponentially larger parameter spaces. Limited v4.0 scored vulnerabilities in initial deployment require transfer learning from v3.x models with domain adaptation techniques, while backward compatibility demands multitarget learning frameworks supporting simultaneous predictions across v2.0/v3.x/v4.0 environments. Furthermore, our objective is to improve software vulnerability management by implementing the Exploit Prediction Scoring System (EPSS), which refines the prioritization process by incorporating exploitation metrics. Methodology, A.B., M.W. and S.S.; Software, A.B., M.W. and M.N. ; Validation, A.B. ; Formal analysis, J.O. and S.S.; Investigation, M.N. ; Data curation, A.B. and M.W. ; Writing--review & editing, A.B. and S.S. All authors have read and agreed to the published version of the manuscript. This work is supported by the \"Implementation Doctorate\" program financed by the Polish Ministry of Education and Science, edition 6 grant No. DWD/6/0320/2022. The authors from Wroclaw University of Science and Technology acknowledge support from statutory activity. Not applicable. The original contributions presented in this study are included in the article. Further inquiries can be directed to the corresponding author. The authors declare no conflicts of interest.