Understanding CVSS Scores
CVSS — the Common Vulnerability Scoring System — converts a vulnerability’s characteristics into a single 0–10 severity number. It gives everyone a consistent way to say “how bad is this flaw, inherently?” so that a CVE arrives with a comparable severity rating. Used well, it helps prioritize; used blindly, it misleads.
What goes into the score?#
The Base score — the one usually quoted — combines two groups of metrics:
- Exploitability: attack vector (network, adjacent, local, physical), attack complexity, privileges required, and user interaction.
- Impact: the effect on confidentiality, integrity, and availability — the CIA triad again.
| Range | Severity |
|---|---|
| 0.0 | None |
| 0.1–3.9 | Low |
| 4.0–6.9 | Medium |
| 7.0–8.9 | High |
| 9.0–10.0 | Critical |
There are also Temporal and Environmental metrics that adjust the score for exploit availability and your specific environment — often ignored, though the Environmental group is exactly what makes the score relevant to you.
Why is a high score not the same as high risk?#
Because the Base score describes the vulnerability, not your exposure. A “critical” flaw in software you do not run, or on a system no attacker can reach, is low risk to you. Conversely, a “medium” flaw on your internet-facing authentication server may be the thing to fix first.
CVSS is a key input to vulnerability management. More at the Security Fundamentals hub.
Frequently asked questions#
What do CVSS score ranges mean?
CVSS scores run 0–10: 0.1–3.9 is Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical. The number is calculated from metrics like attack vector, complexity, privileges required, and impact to confidentiality, integrity, and availability. Higher means the flaw is easier to exploit or more damaging.
Is a high CVSS score the same as high risk?
No. CVSS Base scores measure a vulnerability’s inherent severity, not your risk. A 9.8 flaw on an isolated test box may matter less than a 6.5 on your internet-facing crown-jewel system. Risk combines CVSS with exploitability in the wild and your own asset context — treat the score as an input, not a verdict.