What is CVSS (Common Vulnerability Scoring System)?

How CVSS Works

CVSS evaluates vulnerabilities using multiple metric groups. Base metrics measure intrinsic characteristics like attack vector, attack complexity, privileges required, user interaction, and impact on confidentiality, integrity, and availability. CVSS v4.0 introduced Attack Requirements and split impact assessment between the vulnerable system and subsequent systems.

Temporal metrics (Threat metrics in v4.0) capture time-based factors like exploit code maturity and remediation level. Environmental metrics customize scores based on asset criticality and existing controls. Supplemental metrics cover automatability and recovery capability.

The scoring process generates numerical scores and vector strings showing all metric values. The National Vulnerability Database enriches all CVE records with CVSS base scores but does not assess temporal or environmental metrics.

Why CVSS Matters

Before CVSS launched in 2005, vulnerability severity assessment was fragmented. Vendors used proprietary scoring without standardized definitions, making cross-organization collaboration nearly impossible. CVSS provides a repeatable, vendor-neutral methodology enabling security teams to compare vulnerabilities across products.

The NVD attaches CVSS scores to over 200,000 CVE entries (NIST NVD, 2026). Over 40,000 CVEs were published in 2024, with mid-sized enterprises managing 50,000 to 150,000 vulnerabilities at any given time.

However, CVSS measures technical severity in isolation without assessing actual organizational risk or real-world exploitability. Security professionals should use CVSS as one input within a broader strategy, complemented by threat intelligence, EPSS, security information and event management, and organizational context.

CVSS vs. CVE

CVE identifies vulnerabilities with unique IDs, while CVSS scores their technical severity. The two systems are complementary.

Common Misconceptions

CVSS critical scores require immediate patching. A critical CVSS score (9.0-10.0) indicates high technical severity but does not account for whether the vulnerability is exploitable in your environment or actively targeted by attackers. Organizations that patch based solely on CVSS scores often experience alert fatigue while missing medium-scored vulnerabilities under active exploitation.

CVSS versions score vulnerabilities consistently. Different CVSS versions can produce different scores for the same vulnerability due to changes in metrics and formulas. A vulnerability might score 8.1 in v2.0, 7.5 in v3.1, and 8.2 in v4.0, creating prioritization inconsistencies.