The Common Vulnerability Scoring System (CVSS) is an open standard that rates the technical severity of software vulnerabilities on a scale from 0.0 to 10.0.
How CVSS works
CVSS is maintained by FIRST (Forum of Incident Response and Security Teams). Version 3.1 is still the most widely used; version 4.0 was released in November 2023. The base score is calculated from characteristics of the vulnerability:
- attack vector – network, adjacent, local or physical;
- attack complexity and required privileges and user interaction;
- impact on confidentiality, integrity and availability.
The result is written as a vector string, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8. Qualitative ratings are: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0). Additional metric groups let organizations adjust the score for exploit availability and their own environment.
Why CVSS matters for security
CVSS gives vendors, databases like the NVD and security teams a common language: news about a “critical CVSS 9.8 flaw” usually means an unauthenticated remote code execution. But CVSS measures severity, not risk. Most vulnerabilities are never exploited, while some medium-rated bugs are used in real attacks. Treating CVSS as the only priority leads to endless patch lists.
Using CVSS correctly
- Combine CVSS with exploitation data: the CISA KEV catalog and the EPSS probability score.
- Consider exposure – is the system reachable from the internet? – and business criticality.
- Read the vector, not just the number: “local” and “requires user interaction” change the picture.
