Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System (CVSS) is a standardized, open framework for rating the technical severity of a software vulnerability on a scale from 0 to 10. Maintained by FIRST, CVSS produces a score based on measurable characteristics of the vulnerability itself, such as how the flaw is reached over a network, how complex the attack is to carry out, whether authentication is required, and what impact successful exploitation would have on confidentiality, integrity and availability.

CVSS is widely used because it gives every vulnerability a consistent, comparable number regardless of who discovered it or which vendor's product is affected. A score in the 9.0 to 10.0 range is generally labeled critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, and below 4.0 low, giving teams a rough sorting mechanism when triaging a large backlog of findings. Nearly every vulnerability database, scanner and advisory references a CVSS score alongside the CVE identifier for exactly this reason.

The important limitation of CVSS is that it measures theoretical technical severity, not the likelihood that a vulnerability will actually be exploited in practice. A vulnerability can have a critical CVSS score of 9.8 and never see meaningful real-world exploitation because it requires conditions rarely present outside a lab, while a moderate-severity flaw can become the basis of a widespread campaign because it happens to be trivially easy to reach on internet-facing systems. Relying on CVSS alone for prioritization routinely results in security teams spending effort on flaws that pose little practical danger while missing ones that attackers are actively using.

Because of this gap, mature exposure and vulnerability management programs treat CVSS as one input among several rather than the sole prioritization criterion. Combining CVSS with the CISA KEV catalog, which confirms actual observed exploitation, and EPSS, which estimates exploitation probability, produces a far more actionable priority ranking than CVSS alone. Business context matters too: a critical CVSS finding on an internal, air-gapped test system is a very different priority than the same CVSS score on an internet-facing production login page.

CVSS has evolved across several major versions, most recently version 4.0, each attempting to better capture real-world attack conditions and reduce scoring ambiguity between different assessors rating the same vulnerability. Despite its limitations, CVSS remains the closest thing the industry has to a universal severity language, and it continues to be a required or expected data point in nearly every vulnerability disclosure, advisory and compliance framework.