Cybersecurity glossary
What is the Common Vulnerability Scoring System (CVSS)?
Learn what CVSS is, how Base Temporal and Environmental metrics work, how to read CVSS v3 and v4 scores, and why severity alone is not enough for patch priority.
Definition
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities as numeric scores and vector strings, typically published with CVE records so organizations can compare relative severity in a consistent way.
Why teams rely on CVSS
When hundreds of CVEs land in a week, “critical” without a shared definition is useless. The Common Vulnerability Scoring System (CVSS) gives vendors, NVD, and security teams a common language for severity: a score, a qualitative rating, and a vector that explains why the number looks that way.
CVSS is excellent for consistent communication. It is a poor substitute for “what should we patch tonight?”
How CVSS scoring is structured
Assess Base (or equivalent) metrics
Capture intrinsic qualities: how the flaw is reached, privileges needed, user interaction, and impact on confidentiality, integrity, and availability.
Produce a Base score and vector
The formula yields a 0–10 score plus a vector string documenting each metric choice.
Optionally apply Threat / Temporal factors
Exploit maturity, remediation level, and report confidence can adjust urgency over time.
Customize with Environmental metrics
Organizations weight impact for their assets and account for controls that change exposure.
Combine with other signals to prioritize
Pair the score with EPSS, KEV, asset criticality, and reachable attack paths.
Metric groups at a glance
Base metrics
Describe the vulnerability as published—independent of your network or patch status.
Threat / Temporal
Reflect changing exploit reality: proof-of-concept code, active use, or available fixes.
Environmental
Tune impact for your crown jewels and defenses (segmentation, WAF, MFA).
Supplemental (v4)
Additional context that informs response without always rewriting the primary score.
Reading scores without overreacting
| Signal | Healthy use |
|---|---|
| CVSS 9.0–10.0 | Treat as high technical severity; still confirm exposure and exploitability |
| Network + low privileges | Often internet-facing urgency if the asset is reachable |
| Requires admin / local access | Prioritize on hosts that already face compromise risk |
| User interaction required | Pair with phishing and client-hardening controls |
| Vector string mismatch | Re-score or challenge vendor metrics when your topology differs |
- Store both the numeric score and the full vector string in tickets and dashboards.
- Prefer Environmental adjustments for your most critical systems instead of raw Base alone.
- Never patch solely by CVSS rank—add EPSS, KEV, and internet exposure.
- Revisit scores when public exploit code or mass scanning appears.
- Train analysts to explain vectors in plain language to engineering owners.
- Watch for scanner default scores that ignore authentication or segmentation.
- Document when you accept a high CVSS risk with compensating controls.
- Align SLAs to severity bands, then allow exception workflows for context.
The practical takeaway
CVSS standardizes how we talk about vulnerability severity. Use it to compare technical characteristics, then decide priority with exploit intelligence and business context.
A 10.0 on an unreachable lab VM can wait. A mid-score bug on your public SSO path often cannot.
Related security terms
Common Vulnerabilities and Exposures (CVE)
Public IDs that CVSS scores are usually attached to.
Exploit Prediction Scoring System (EPSS)
Complements CVSS with likelihood-of-exploitation estimates.
Exploitability
Concept reflected in CVSS attack metrics and real-world conditions.
Remediation
Actions taken after severity and exposure drive priority.
False Positive
Scanner noise that can inflate high-CVSS backlogs without real exposure.
Frequently asked questions
What is CVSS in simple terms?
CVSS is a shared 0–10 severity scale for vulnerabilities. A higher score means the flaw’s technical impact and ease of abuse look worse under the metric rules—not automatically that you must patch first.
Who maintains CVSS?
FIRST (Forum of Incident Response and Security Teams) maintains the CVSS specification used widely by NVD and vendors.
What is a CVSS vector string?
It is a compact encoding of metric choices (for example attack vector and privileges required) so others can reproduce or adjust the score.
What changed in CVSS v4?
CVSS v4 refined metrics, naming, and supplemental guidance to better express modern attack conditions while remaining compatible with severity communication goals.
Is a 9.8 always more urgent than a 7.5?
Not necessarily. Exposure, asset criticality, active exploitation (KEV), and EPSS can make a lower score more urgent in your environment.
Should I use Base, Temporal, or Environmental scores?
Vendors and NVD often publish Base (and sometimes Threat/Temporal) scores. Environmental metrics should be adjusted internally for your controls and asset value.
Does CVSS measure business risk?
No. It measures technical severity characteristics. Business risk needs context: data sensitivity, blast radius, and compensating controls.
References
Explore authoritative guidance and frameworks related to common vulnerability scoring system (cvss).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.