CVSS (severity score)
CVSS · Common Vulnerability Scoring System · CVSS score · CVSS v4.0 · CVSS v3.1 · severity rating
A scoring system from 0 to 10 that measures the technical severity of a vulnerability, based on criteria such as how easy it is to exploit and its impact on data and service.
In practice
CVSS is maintained by FIRST. Version 4.0, published in November 2023, coexists with version 3.1, still widely used by databases and tools. The base score describes the flaw itself: network or local access, complexity, privileges or user action required, impact on confidentiality, integrity and availability; v4.0 adds threat and environmental metrics, with explicit labels (CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE). Scores read as follows: low from 0.1 to 3.9, medium from 4.0 to 6.9, high from 7.0 to 8.9, critical from 9.0 to 10. CVSS measures severity, not the likelihood of an attack.
Fictional case: a team receives 400 “high” or “critical” alerts a month. By combining CVSS with EPSS, the KEV catalogue and internet exposure, it cuts its “fix this week” list down to a dozen patches.
