CVSS Score: Common Vulnerability Scoring Guide

The Common Vulnerability Scoring System (CVSS) is an open industry standard used worldwide to measure the technical severity of software, firmware, and hardware vulnerabilities. Governed by the Forum of Incident Response and Security Teams (FIRST), a CVSS score provides IT administrators, security engineers, and institutional researchers with a standardized numerical baseline (from 0.0 to 10.0) to capture the intrinsic characteristics and potential damage of a disclosed flaw.

What does CVSS score stand for?

CVSS stands for the Common Vulnerability Scoring System . A CVSS score is a numerical value calculated from a formal vector string that records specific technical attributes of a vulnerability, including how an attacker accesses the target, the level of privileges required, and the degree of impact on confidentiality, integrity, and availability.

CVSS divides scoring metrics into distinct groups:

Base Metrics (CVSS-B): Evaluate the fundamental, immutable qualities of a vulnerability that do not vary over time or across different user deployment environments.

Threat Metrics (CVSS-BT, formerly Temporal): Measure the current state of exploit techniques or code availability in the wild.

Environmental Metrics (CVSS-BE / CVSS-BTE): Enable downstream consumers to customize the score to reflect organizational mitigating controls and specific asset value.

Who runs it and what it covers

CVSS is developed and maintained by the FIRST CVSS Special Interest Group (CVSS-SIG) , an international collaboration of commercial vendors, security researchers, academic institutions, and government bodies. The National Institute of Standards and Technology (NIST) supports CVSS through the National Vulnerability Database (NVD), which calculates and publishes standardized CVSS scores for all publicly disclosed vulnerabilities cataloged under Common Vulnerabilities and Exposures (CVE).

CVSS covers any disclosed security defect across operating systems, enterprise applications, industrial control systems, cloud platforms, and connected research instruments. While the scoring methodology is designed by FIRST, organizations across the globe ingest CVSS metrics through automated scanners and vulnerability databases.

How to or use it

Security teams can evaluate vulnerabilities and generate CVSS scores using official calculators and public registries through the following steps:

Locate the CVE disclosure: Identify the target vulnerability record in the NIST NVD repository or vendor advisory to review the published CVSS vector string and base rating.

Access the official calculator: Open the FIRST CVSS Calculator or NIST NVD CVSS Calculator to inspect or recalculate specific metric values.

Evaluate Exploitability metrics: Assign ratings for Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity (Low, High), Attack Requirements (None, Present in v4.0), Privileges Required (None, Low, High), and User Interaction (None, Passive, Active).

Assess Impact metrics: In CVSS v4.0, score the technical impact across two distinct layers: the Vulnerable System (VC, VI, VA) and any downstream Subsequent System (SC, SI, SA) for Confidentiality, Integrity, and Availability.

Generate the vector string: Combine individual metric designations into a standardized shorthand text string (for example, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N ).

Derive the numerical score: Calculate the final score on the 0.0 to 10.0 scale using the official lookup algorithm.

Adjust for threat and environment: Where local controls (such as firewalls or network segmentation) reduce exposure, apply Environmental metrics to produce a tailored score.

CVSS score ranges and severity bands

CVSS scores map directly to qualitative severity ratings established by FIRST and NIST. The standard severity scale is divided into five distinct tiers:

None (0.0): Indicates no technical vulnerability or negligible security exposure.

Low (0.1–3.9): Local or complex attacks requiring significant privileges with minimal operational impact.

Medium (4.0–6.9): Flaws that typically require user interaction, specific privileges, or cause partial service disruption.

High (7.0–8.9): Significant vulnerabilities often exploitable remotely with low privileges that can cause substantial system disruption or data exposure.

Critical (9.0–10.0): Severe vulnerabilities (such as unauthenticated remote code execution) that can allow attackers to compromise systems entirely without user assistance. The highest possible CVSS score is 10.0 .

Differences between CVE and CVSS in cybersecurity

While often mentioned together, CVE and CVSS serve distinct, complementary functions in vulnerability management:

CVE (Common Vulnerabilities and Exposures): An identification catalog maintained by MITRE and the CVE Program. A CVE identifier (e.g., CVE-2021-44228 ) is a unique tracking name assigned to a specific flaw so organizations can reference the exact same issue across vendors, advisories, and scanners. CVE does not assign a severity score.

CVSS (Common Vulnerability Scoring System): The evaluation framework that assesses how severe that identified CVE flaw is. While CVE provides the label, CVSS provides the technical severity rating.

What is CVSS v4.0 and what changed?

Published by FIRST as the latest major standard revision, CVSS v4.0 introduced several structural enhancements over CVSS v3.1:

Nomenclature clarity: To reinforce that Base scores do not equal operational risk, v4.0 standardizes explicit naming: CVSS-B (Base), CVSS-BT (Base + Threat), CVSS-BE (Base + Environmental), and CVSS-BTE (Base + Threat + Environmental).

Separation of Attack Complexity and Requirements: CVSS v4.0 separates conditions that evade security defenses (Attack Complexity) from execution prerequisites such as race conditions or specific configurations (Attack Requirements).

Replacement of Scope: In v3.1, the Scope metric caused significant scoring anomalies. CVSS v4.0 replaces Scope by explicitly scoring impacts across both the Vulnerable System and the Subsequent System.

Supplemental metrics: Introduces optional contextual signals that convey operational context without altering the mathematical score, including Safety (human physical harm under IEC 61508 standards), Automatable, and Provider Urgency.

CVSS provides an essential common language for technical risk, but security leaders must understand its design boundaries:

Strengths: Standardized consensus: Ensures vendors, customers, and auditors evaluate technical flaws using identical definitions. Granular transparency: The vector string exposes exact technical attack mechanics rather than a vague qualitative summary. Vendor neutrality: Maintained by an open international consortium without commercial bias.

Standardized consensus: Ensures vendors, customers, and auditors evaluate technical flaws using identical definitions.

Granular transparency: The vector string exposes exact technical attack mechanics rather than a vague qualitative summary.

Vendor neutrality: Maintained by an open international consortium without commercial bias.

Limits: Severity is not risk: A CVSS Base score reflects what a vulnerability could do in isolation, not whether attackers are actively weaponizing it. Score clustering: A large percentage of disclosed vulnerabilities receive High or Critical ratings, creating alert fatigue when used as the sole triage filter.

Severity is not risk: A CVSS Base score reflects what a vulnerability could do in isolation, not whether attackers are actively weaponizing it.

Score clustering: A large percentage of disclosed vulnerabilities receive High or Critical ratings, creating alert fatigue when used as the sole triage filter.

To overcome these limitations, modern enterprise frameworks such as NIST Cybersecurity Framework 2.0 , CMMC compliance mandates , and institutional cybersecurity operations pair CVSS severity with empirical exploit forecasting frameworks like the Exploit Prediction Scoring System (EPSS) .

Alternatives and complementary frameworks

Vulnerability management programs rarely rely on CVSS alone. The table below outlines how CVSS compares to complementary vulnerability assessment standards:

Frequently Asked Questions

What is the highest CVSS score?

The highest possible CVSS score is 10.0 , classified as Critical. A 10.0 score occurs when a vulnerability is remotely exploitable over a network with no authentication, requires no user interaction, and causes complete loss of confidentiality, integrity, and availability.

What are the four types of vulnerability?

In cybersecurity and risk management frameworks, vulnerabilities are broadly categorized into four operational types: network vulnerabilities (unprotected ports or protocol flaws), software vulnerabilities (coding errors like buffer overflows or injection flaws), configuration vulnerabilities (default passwords or misconfigured access controls), and human or operational vulnerabilities (susceptibility to social engineering, phishing, or poor credential hygiene).

What are common vulnerability management tools that ingest CVSS?

Industry-standard vulnerability management tools that automatically scan assets and parse CVSS metrics include Tenable Nessus, Qualys VMDR, Rapid7 InsightVM, OpenVAS (Greenbone), and Microsoft Defender Vulnerability Management. These platforms ingest NVD CVSS vectors to index and prioritize institutional assets.

FIRST Common Vulnerability Scoring System Overview: (November 8, 2026)

FIRST CVSS v4.0 Specification Document: (November 8, 2026)

FIRST CVSS v4.0 User Guide: (November 8, 2026)

FIRST CVSS v4.0 Frequently Asked Questions: (November 8, 2026)

NIST National Vulnerability Database CVSS Metrics: (November 8, 2026)

Research-administration guidance, standards updates and independent tool reviews.