A vulnerаbility scаn finds twо CVEs. CVE A hаs a CVSS scоre оf 9.1 on an internal server in a private subnet with no internet access. CVE B has a CVSS score of 7.5 on an internet-facing web server, and a public exploit for it is already circulating. Which should be patched first? Explain why the CVSS score alone shouldn't decide.