What is CVSS (Common Vulnerability Scoring System)?
Updated
The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by FIRST.org, for rating the severity of a software vulnerability on a scale from 0 to 10. It answers one specific question — how bad would this flaw be if it were exploited — by scoring the vulnerability's intrinsic technical characteristics.
CVSS is the most widely used severity language in security, but it measures impact, not likelihood. A high CVSS score says a flaw would be damaging if used; it says nothing about whether anyone is using it. That is why CVSS is best paired with exploitation signals like EPSS and the CISA KEV catalog rather than used as a standalone priority list.
The three metric groups: base, temporal, environmental
A CVSS score is built from three groups of metrics. The base score captures the constant qualities of the vulnerability — how it is accessed, how complex the attack is, what privileges are needed, and its impact on confidentiality, integrity, and availability. This is the number most people mean when they cite 'the CVSS score,' and it does not change over time.
The temporal group adjusts for factors that evolve, such as whether exploit code exists and whether a fix is available. The environmental group lets an organization re-score for its own context — how exposed the affected asset is, how important it is. Most published scores are base-only, so two organizations can rationally treat the same base score very differently once environment is considered.
| Score range | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
Why CVSS alone is a poor priority list
Sorting a backlog by CVSS floods the top with severe-but-unexploited vulnerabilities, because most high-severity flaws are never actually attacked. Teams that patch strictly in CVSS order spend disproportionate effort on flaws that pose little real-world risk while confirmed-exploited medium-severity issues wait. Severity is necessary context, not a complete answer.
The stronger approach combines three signals: CVSS for impact, EPSS for the probability of near-term exploitation, and CISA KEV for confirmed active exploitation — then weights by whether the affected component is actually reachable in your environment. CVSS supplies the 'how bad,' but 'how likely' and 'is it happening now' are what turn a large list into a short, defensible one.
Frequently asked questions
What is a good or bad CVSS score?
CVSS runs 0 to 10. In CVSS v3.x, 0.1–3.9 is Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical. A higher score means greater potential impact if the flaw is exploited, but it does not indicate how likely exploitation is — so a Critical score is a signal to investigate, not an automatic top priority.
What is the difference between the base, temporal, and environmental scores?
The base score reflects the vulnerability's constant technical characteristics and does not change. The temporal score adjusts for evolving factors like exploit availability and remediation. The environmental score lets an organization re-weight for its own context — asset exposure and importance. Most published scores are base-only.
Should I prioritize patching by CVSS score?
Not by CVSS alone. Severity tells you how damaging a flaw would be, not whether it is being exploited. Combine CVSS with EPSS (exploitation likelihood) and the CISA KEV catalog (confirmed active exploitation), and weight by whether the asset is actually exposed, to build a priority list that reflects real risk.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.