The Common Vulnerability Scoring System (CVSS) describes the technical characteristics and severity of a specific vulnerability. Its output is a value from 0.0 to 10.0 and a vector showing how that value was derived. CVSS neither classifies a weakness like CWE nor assigns an identifier like CVE.
How is CVSS 4.0 structured?
| Metric group | Meaning |
|---|---|
| Base | Characteristics independent of time and deployment: attack path, complexity, prerequisites, privileges, user interaction and technical impact. |
| Threat | Changing threat conditions, particularly the maturity of available exploits. |
| Environmental | Local asset importance, controls and adjusted impact in the consumer's environment. |
| Supplemental | Context such as automation, safety, recovery and provider urgency; does not change the score. |
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1–3.9 | Low |
| 4.0–6.9 | Medium |
| 7.0–8.9 | High |
| 9.0–10.0 | Critical |
How do you read a CVSS vector?
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NThis illustrative Base vector describes a network attack with low complexity, no additional requirements, privileges or user interaction. Confidentiality, integrity and availability of the vulnerable system have high impact; no direct impact on subsequent systems is claimed. A published score should always include its vector and CVSS version.
Why is CVSS not a risk score?
A high Base score does not automatically determine remediation order. CVSS initially knows neither the value and exposure of your asset nor compensating controls or observed attacks. An isolated test instance and a public production service may share a Base score while presenting very different risk. Prioritization should additionally use EPSS, the CISA KEV Catalog, exposure, data classification, attack paths and local controls.
How should CVSS be used?
- Check the vector:
Published assumptions may not match the installed configuration. - Add Threat metrics:
Update exploit maturity and threat intelligence over time. - Model the environment:
Account for asset importance, reachable impact and effective controls. - Document the decision:
Keep score, context, owner, deadline and accepted exceptions together.
Thank you for your feedback! We will review it and optimize this content.