The Common Vulnerability Scoring System (CVSS) is an open framework for describing the characteristics and severity of software vulnerabilities. It produces a numerical score from 0 to 10, which is often translated into ratings such as low, medium, high and critical. CVSS is maintained by FIRST, the Forum of Incident Response and Security Teams.

How it works

• Base metrics describe qualities that do not change, such as attack vector, complexity, privileges required, user interaction and impact on confidentiality, integrity and availability.
• Threat metrics reflect factors that change over time, such as whether exploit code exists.
• Environmental metrics adjust the score for a specific organization, for example how important the affected system is.
• Supplemental metrics add context without changing the score.

A vector string records the chosen values, so anyone can see how a score was derived.

Why it matters for defenders

CVSS measures severity, not risk. A high base score on an internal test system may matter less than a medium score on an internet-facing login portal that attackers are actively exploiting. Good vulnerability management combines CVSS with exposure, asset value and threat intelligence, such as the KEV catalog or underground discussion of a CVE.

Sources: FIRST: Common Vulnerability Scoring System SIG, FIRST: CVSS v4.0 Specification Document