How CVSS Scores Work?
CVSS is maintained by FIRST, the Forum of Incident Response and Security Teams. A score starts from Base metrics that describe the flaw itself, such as how it is exploited and what it impacts, and can be refined with further metrics for your specific context. The current version is CVSS v4.0, released in 2023, though many advisories still use v3.1. The two are not directly comparable, because the metrics and weighting changed between them. Whatever the version, every numeric score maps to a plain-English severity band, and those bands are the part most people actually use day to day.
| CVSS score | Severity rating |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
What Goes Into a CVSS Base Score?
The Base score is built from a handful of questions about the vulnerability. Each one nudges the number up or down, and together they explain why two flaws with the same impact can score very differently.
| Base metric | What it measures |
|---|---|
| Attack Vector | How close the attacker must be: network, adjacent, local, or physical |
| Attack Complexity | How much has to line up for the attack to succeed |
| Privileges Required | What access the attacker needs before exploiting the flaw |
| User Interaction | Whether a victim has to do something, like click a link |
| Scope | Whether the impact spreads beyond the vulnerable component |
| Impact (C, I, A) | Damage to confidentiality, integrity, and availability |
CVSS v4.0 vs v3.1
CVSS v4.0 keeps the same 0.0 to 10.0 scale and the same severity bands, so a Critical is still a Critical. What changed is under the hood. Version 4.0 splits user interaction into passive and active, adds an Attack Requirements metric, and reorganizes the optional metrics into Threat, Environmental, and Supplemental groups. The goal was to make scores more precise and less likely to pile every flaw into the Medium and High range. Because the weighting differs, you should not compare a v4.0 base score directly against a v3.1 score for the same flaw; check which version an advisory used before you read too much into a single number.
Why a CVSS Score Is Not the Whole Story
A CVSS base score measures severity, not risk. A Critical 9.8 on an internal test box you never expose matters less than a High 7.5 on your public login page. Sharp teams layer exploitation signals on top of the number: whether a public exploit exists, whether the flaw sits on CISA’s Known Exploited Vulnerabilities catalog, and whether the asset is internet-facing. It also pays to confirm the finding is real and not a false positive before you act. This is exactly what the Threat and Environmental metric groups are for, yet many advisories publish only the base score, which is why raw CVSS should start your prioritization, not end it.
Prioritize by severity times exposure times exploitabilityUse the CVSS score as a starting point, then weight it by whether the asset is exposed and whether the flaw is actually being exploited. That is how you fix the three findings that matter instead of three hundred that do not.
Frequently Asked Questions
What CVSS score counts as critical?
A CVSS score of 9.0 to 10.0 is rated Critical. High is 7.0 to 8.9, Medium is 4.0 to 6.9, Low is 0.1 to 3.9, and 0.0 means no severity. These bands are the same across CVSS v3.1 and v4.0.
Is a higher or lower CVSS score worse?
Higher is worse. The scale runs from 0.0 (no severity) to 10.0 (maximum severity), so a 9.8 is far more severe than a 4.0. That said, severity is not the same as risk: a lower-scored flaw on an exposed, actively exploited system can be more urgent than a higher-scored one that no one can reach.
What is the latest version of CVSS?
The latest version is CVSS v4.0, released in 2023 by FIRST. Many vendors and databases still publish CVSS v3.1 scores as well. The scale and severity bands are the same, but the underlying metrics differ, so scores from the two versions are not directly comparable.
A website vulnerability scanner attaches a CVSS score to every finding and ranks them so you fix the most severe, most exposed issues first. Start a free scan to see your findings scored and prioritized.
