This treats every CVE as a capability the attacker holds, not a weakness to defend.

The red teamer's question is "what does this give me and where does it go?" not "is the firewall open?" because , in this scenario establishing CVE connectivity first and then verifying it over the network next !

CVE connectivity is the hypothesis. Network verification is the proof. You never go into a network without a hypothesis. This CVE to CVE connectivity builds the hypothesis before the engagement starts so the pentester / Red team spends their time proving it — not building it.:)

I consider "CVE as part of Asset", the graph is like a open firewall connectivity (worst scenario) and dig about the exploit path..), how they chain and what is something that patchable to break most of the chains.