A security analyst receives a vulnerability scan report showing multiple findings across the organization's web servers. One vulnerability has a CVSS score of 9.8 with active exploits in the wild, but affects a development server with no external access. Another has a CVSS score of 6.5 with no known exploits, but affects the public-facing production web server processing customer transactions. Which factor should the analyst prioritize when determining remediation order?