CVSS Scores Explained: What the Numbers Mean

When you see "CVSS 9.8" next to a vulnerability, it tells you something about how bad it could be. It does not tell you how bad it is for you. Understanding the metrics helps you use scores well.

What CVSS is

The Common Vulnerability Scoring System is an open standard maintained by FIRST for rating vulnerability severity from 0.0 to 10.0. Version 3.1 is still widely used, and version 4.0, released in 2023, is increasingly adopted.

Severity ranges

Base metrics in CVSS v3.1

Exploitability:

• Attack Vector (AV): Network, Adjacent, Local or Physical. Network is the most severe.
• Attack Complexity (AC): Low or High.
• Privileges Required (PR): None, Low or High.
• User Interaction (UI): None or Required.

Scope (S): whether the impact extends beyond the vulnerable component, Unchanged or Changed.

Impact:

• Confidentiality (C), Integrity (I) and Availability (A): None, Low or High.

A typical unauthenticated remote code execution looks like:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H  -> 9.8 Critical

What changed in CVSS v4.0

• Attack Requirements (AT) was added alongside Attack Complexity.
• User Interaction gained more granularity: None, Passive or Active.
• Scope was replaced by separate impact metrics for the vulnerable system and subsequent systems.
• Nomenclature distinguishes CVSS-B (base only), CVSS-BT (with threat), CVSS-BE (with environmental) and CVSS-BTE.
• Threat metrics replace temporal metrics, focusing on exploit maturity.
• Supplemental metrics add context like automatable and recovery, without changing the score.

Base, threat and environmental scores

The number published with a CVE is usually the base score: the worst-case severity in a generic environment. CVSS also supports:

• Threat (or temporal) metrics: whether exploit code exists and how mature it is.
• Environmental metrics: your context, such as whether the system is exposed and how important it is.

Adjusting for your environment can move a 9.8 down to a 5 for an unreachable internal component, or keep it critical for an internet-facing service.

Why CVSS alone is not a priority list

• It ignores whether the vulnerability is actively exploited.
• It does not know whether the vulnerable code is reachable in your app.
• It does not reflect the value of the affected data.

Combine CVSS with exploitation data, such as CISA KEV and EPSS, and your own exposure. See our CVE vulnerability management guide.

CVSS in pentest reports

Penetration test findings often include CVSS vectors. Read the vector, not just the number, to understand why a finding scored as it did. SecurityInfinity ranks findings by severity with context about exposure and verified impact. Start free.

Frequently asked questions

Who assigns CVSS scores to CVEs?

The CVE numbering authority, vendor or national databases like NVD may provide scores, and they sometimes differ.

Is CVSS v4.0 replacing v3.1?

Adoption of v4.0 is growing, but many tools and databases still publish v3.1 scores, so you will see both.

Can I calculate CVSS myself?

Yes. FIRST provides official calculators for each version, and you can add environmental metrics for your context.