CVSS exists to answer one question: which of these findings should be fixed first. It answers it only partially, because the base score describes the vulnerability and not your environment — and the difference between the two is where most remediation effort is wasted. Understanding what each metric group actually measures is therefore a prerequisite for using the number at all.
What is CVSS?
CVSS (Common Vulnerability Scoring System) is an open industry standard for assessing the severity of security vulnerabilities. The system assigns vulnerabilities a numerical score from 0.0 to 10.0, where higher values indicate greater risk.
| CVSS Score | Category | Example |
|---|---|---|
| 0.0 | None | Vulnerability with no impact |
| 0.1 - 3.9 | Low | Information disclosure |
| 4.0 - 6.9 | Medium | Stored XSS |
| 7.0 - 8.9 | High | SQL injection |
| 9.0 - 10.0 | Critical | Remote code execution without authentication |
CVSS is developed by FIRST (Forum of Incident Response and Security Teams) and serves as the foundation for vulnerability remediation prioritization — including flaws found during a vulnerability assessment — in organizations worldwide.
Why is CVSS Important?
- Standardization - universal language for communicating risk
- Prioritization - helps decide what to fix first
- Compliance - required by many regulations (NIS2, PCI DSS)
- Automation - vulnerability scanners automatically assign CVSS scores
- Comparability - ability to compare vulnerabilities across systems
📚 Read the complete guide: Penetration Testing: Penetration testing - types, methodologies, process
CVSS Version History
| Version | Year | Key Changes |
|---|---|---|
| CVSS v1 | 2005 | First version |
| CVSS v2 | 2007 | Added Temporal and Environmental metrics |
| CVSS v3.0 | 2015 | New metrics: Scope, User Interaction |
| CVSS v3.1 | 2019 | Definition clarification, consistency |
| CVSS v4.0 | 2023 | Nomenclature, OT/ICS, supplemental metrics |
Currently, CVSS v3.1 is most commonly used, but more organizations are transitioning to CVSS v4.0.
CVSS v3.1 Structure
CVSS v3.1 consists of three metric groups:
┌─────────────────────────────────────────────────────────┐
│ CVSS v3.1 SCORE │
├───────────────┬───────────────────┬─────────────────────┤
│ BASE SCORE │ TEMPORAL SCORE │ ENVIRONMENTAL SCORE │
│ (0.0-10.0) │ (modifier) │ (modifier) │
├───────────────┼───────────────────┼─────────────────────┤
│ • Attack Vector │ • Exploit Code │ • Modified Base │
│ • Attack Complex. │ Maturity │ • Confidentiality │
│ • Privileges Req. │ • Remediation │ Requirement │
│ • User Interaction │ Level │ • Integrity Req. │
│ • Scope │ • Report │ • Availability Req. │
│ • Confidentiality │ Confidence │ │
│ • Integrity │ │ │
│ • Availability │ │ │
└───────────────┴───────────────────┴─────────────────────┘Base Score
The Base Score represents the intrinsic characteristics of a vulnerability that don’t change over time or depending on the environment. It’s calculated by the vendor or security researcher.
Exploitability Metrics
| Metric | Values | Description |
|---|---|---|
| Attack Vector (AV) | Network / Adjacent / Local / Physical | How attacker can reach the system |
| Attack Complexity (AC) | Low / High | Whether special conditions are needed |
| Privileges Required (PR) | None / Low / High | Level of privileges for exploitation |
| User Interaction (UI) | None / Required | Whether user action is needed |
Attack Vector (AV) - details:
- Network (N) - attack over network (internet), worst case
- Adjacent (A) - attack from same local network (LAN, Bluetooth)
- Local (L) - attacker needs local system access
- Physical (P) - attacker needs physical device access
Attack Complexity (AC):
- Low (L) - attack can be performed under any conditions
- High (H) - special conditions required (race condition, configuration)
Privileges Required (PR):
- None (N) - no authorization needed
- Low (L) - regular user privileges
- High (H) - administrator privileges
User Interaction (UI):
- None (N) - attack without user involvement
- Required (R) - user must e.g. click a link
Impact Metrics
| Metric | Values | Description |
|---|---|---|
| Confidentiality (C) | None / Low / High | Impact on data confidentiality |
| Integrity (I) | None / Low / High | Impact on data integrity |
| Availability (A) | None / Low / High | Impact on system availability |
Scope (S):
- Unchanged (U) - impact limited to vulnerable component
- Changed (C) - impact extends beyond vulnerable component (e.g., VM escape)
Temporal Score
Temporal metrics account for factors that change over time:
| Metric | Values | Description |
|---|---|---|
| Exploit Code Maturity (E) | Not Defined / Unproven / PoC / Functional / High | Exploit code availability |
| Remediation Level (RL) | Not Defined / Official Fix / Temporary Fix / Workaround / Unavailable | Is there a patch |
| Report Confidence (RC) | Not Defined / Unknown / Reasonable / Confirmed | Certainty vulnerability exists |
Example:
- CVE without public exploit: E=Unproven → lower Temporal Score
- CVE with exploit in Metasploit: E=High → Temporal Score close to Base
Environmental Score
Environmental metrics allow customizing the score to your organization:
| Metric | Description |
|---|---|
| Modified Base Metrics | Modification of base metrics for your environment |
| Confidentiality Requirement (CR) | How important is confidentiality for this asset |
| Integrity Requirement (IR) | How important is integrity |
| Availability Requirement (AR) | How important is availability |
Example: Backup system (high Availability Requirement) with DoS vulnerability:
- Base Score: 5.0 → Environmental Score: 7.5
How to Calculate CVSS?
Base Score Formula
CVSS calculation is complex. In practice, calculators are used:
- FIRST CVSS Calculator: https://www.first.org/cvss/calculator/3.1
- NVD Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
- Built into scanners: Nessus, Qualys, Rapid7
Calculation Example
CVE-2021-44228 (Log4Shell):
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Breakdown:
- Attack Vector (AV): Network (N) - attack over internet
- Attack Complexity (AC): Low (L) - easy to execute
- Privileges Required (PR): None (N) - no authentication
- User Interaction (UI): None (N) - no user involvement
- Scope (S): Changed (C) - impact beyond Log4j
- Confidentiality (C): High (H) - full data read
- Integrity (I): High (H) - full modification
- Availability (A): High (H) - full unavailability
Base Score: 10.0 (Critical)CVSS v4.0 - What’s New
In November 2023, FIRST released CVSS v4.0 with significant changes:
New Nomenclature
| CVSS v3.1 | CVSS v4.0 |
|---|---|
| Base Score | CVSS-B |
| Temporal Score | CVSS-BT (Base + Threat) |
| Environmental Score | CVSS-BE (Base + Environmental) |
| - | CVSS-BTE (Base + Threat + Environmental) |
New Metrics
- Attack Requirements (AT) - technical requirements on attacker’s side
- Supplemental Metrics - Safety, Automatable, Recovery, Provider Urgency
- Better OT/ICS support - Safety metrics
Key Changes in v4.0
- Scope removed - replaced by Vulnerable System (VC/VI/VA) and Subsequent System (SC/SI/SA)
- Temporal → Threat - simplified to Exploit Maturity
- New Attack Complexity values - Low → None/Present
- Supplemental Metrics - additional context without score impact
CVSS vs EPSS - What to Choose?
| Aspect | CVSS | EPSS |
|---|---|---|
| What it measures | Theoretical severity | Exploitation probability |
| Scale | 0.0 - 10.0 | 0% - 100% |
| Variability | Static (Base) | Dynamic (daily) |
| Source | Technical analysis | Machine learning on real data |
| Use case | Compliance, SLA | Operational prioritization |
Recommendation: Use CVSS + EPSS together:
- CVSS ≥ 7.0 AND EPSS ≥ 10% → Urgent remediation
- CVSS ≥ 9.0 (regardless of EPSS) → Urgent remediation
- EPSS ≥ 30% (regardless of CVSS) → Consider urgent remediation
CVSS Limitations
CVSS isn’t perfect - know its weaknesses:
- No business context - CVSS doesn’t know the server is critical for production
- Score inflation - a large share of CVEs have CVSS ≥ 7.0, making prioritization difficult
- Static nature - Base Score doesn’t change even when exploit appears
- No exploitation info - CVSS doesn’t tell if vulnerability is actively exploited
Solution: Supplement CVSS with:
- EPSS (exploitation probability)
- CISA KEV (known exploited vulnerabilities)
- Business context (asset criticality)
How to Use CVSS in Your Organization?
Vulnerability Remediation SLA
| CVSS Score | Category | Remediation SLA |
|---|---|---|
| 9.0 - 10.0 | Critical | 24-72 hours |
| 7.0 - 8.9 | High | 7 days |
| 4.0 - 6.9 | Medium | 30 days |
| 0.1 - 3.9 | Low | 90 days |
Prioritization with Context
Priority = CVSS Base Score
× Environmental Modifier
× (EPSS > 10% ? 1.5 : 1.0)
× (In CISA KEV ? 2.0 : 1.0)Reporting for Management
Don’t show management raw CVSS scores. Instead:
"We detected 45 critical vulnerabilities (CVSS ≥ 9.0),
of which 8 are actively exploited in attacks (CISA KEV).
These 8 require remediation within 48 hours."Tools for Working with CVSS
| Tool | Function |
|---|---|
| NVD (nvd.nist.gov) | CVE database with CVSS scores |
| FIRST Calculator | Online CVSS calculator |
| Nessus, Qualys, Rapid7 | Scanners with automatic CVSS |
| Tenable.io | CVSS + VPR (proprietary scoring) |
| cvss-suite (Python) | Library for CVSS calculations |
FAQ
Is CVSS 7.0 always high priority?
No. CVSS 7.0 on an isolated dev system may have lower priority than CVSS 5.0 on a production payment server. Use Environmental Score.
Why do different scanners show different CVSS scores?
Scanners may use different CVSS versions (v2 vs v3.1) or modify Base Score with proprietary metrics (e.g., Tenable VPR).
Should I fix all CVSS ≥ 7.0?
Ideally - yes. In practice - prioritize based on:
- CISA KEV (active exploitation)
- EPSS ≥ 10%
- Internet exposure
- Asset criticality
How to convince management to invest using CVSS?
Translate CVSS into business language:
- “100 critical vulnerabilities” → “100 potential entry points for ransomware”
- “CVSS 9.8” → “Attacker can take full control without a password”
Summary
- CVSS is the standard for assessing vulnerability severity on a 0.0-10.0 scale
- Base Score represents intrinsic vulnerability characteristics (doesn’t change)
- Temporal Score accounts for exploit and patch availability
- Environmental Score allows customizing to your organization
- CVSS v4.0 introduces better OT/ICS support and new nomenclature
- CVSS + EPSS + CISA KEV is the best combination for prioritization
- Don’t rely solely on CVSS - add business context
Need help with vulnerability management? Check our Vulnerability Management services or contact nFlo experts.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Vulnerability Management — Vulnerability Management is a systematic process of identifying, assessing,…
- AI Security — AI Security is a cybersecurity discipline focused on protecting artificial…
- Security Architecture Analysis — Security Architecture Analysis is the process of evaluating, reviewing, and…
- IT Security Architecture — IT security architecture is a structural approach to designing, implementing,…
- Security Architecture — Security architecture is a comprehensive approach to designing, implementing,…
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
