What Is the Common Vulnerability Scoring System (CVSS)?
The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework developed and maintained by FIRST (Forum of Incident Response and Security Teams). It provides a universal language for describing the characteristics and severity of software vulnerabilities, enabling security teams, vendors, and organizations to communicate risk with precision and consistency.
CVSS assigns a numerical score between 0.0 and 10.0 to a vulnerability, with higher scores indicating greater severity. The scoring system is widely adopted by the National Vulnerability Database (NVD), major security vendors, CVE entries, and regulatory frameworks including PCI DSS and FedRAMP.
CVSS v3.1: The Current Standard
CVSS version 3.1, published in June 2019, is the currently recommended standard. It refines version 3.0 by clarifying the meaning of several metrics and improving scoring consistency. Version 3.1 addresses ambiguities in how Scope, Privileges Required, and Attack Complexity were interpreted, resulting in more reproducible scores across different analysts.
While CVSS v4.0 was announced in 2023, CVSS v3.1 remains the dominant version in active use across vulnerability databases, security tools, and organizational policies.
CVSS Score Severity Ratings
FIRST defines five severity qualitative ratings that map to score ranges:
| Rating | Score Range | Description |
|---|---|---|
| None | 0.0 | No impact; not a true vulnerability |
| Low | 0.1 – 3.9 | Limited impact, often requiring local access or complex conditions |
| Medium | 4.0 – 6.9 | Moderate impact; partial exploitation possible |
| High | 7.0 – 8.9 | Significant impact; typically remotely exploitable |
| Critical | 9.0 – 10.0 | Maximum impact; network-exploitable, no authentication required |
The Three CVSS Score Groups
Base Score
The Base Score represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It is composed of two metric groups: Exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope) and Impact metrics (Confidentiality, Integrity, Availability). The Base Score is the most widely reported CVSS score.
Temporal Score
The Temporal Score refines the Base Score by accounting for factors that change over time. It includes Exploit Code Maturity (is working exploit code publicly available?), Remediation Level (is a patch or workaround available?), and Report Confidence (how certain are we about the vulnerability's existence?). A newly published vulnerability with a functional exploit and no patch would score higher temporally than the same vulnerability after a patch is released.
Environmental Score
The Environmental Score allows organizations to customize the score based on their specific infrastructure and security requirements. Modified Base Metrics let you override how the vulnerability behaves in your specific environment, while Confidentiality, Integrity, and Availability Requirements let you specify how critical each impact dimension is to your organization. A vulnerability affecting a non-critical development server carries lower risk than the same vulnerability on a production payment system.
Why CVSS Matters for Security Teams
CVSS scores are the backbone of vulnerability prioritization programs. Security teams receive hundreds — sometimes thousands — of vulnerability alerts monthly. Without a standardized scoring system, teams would spend excessive time debating risk levels instead of remediating vulnerabilities. CVSS enables:
- Consistent prioritization across teams and tooling
- SLA enforcement — e.g., Critical vulnerabilities must be patched within 24 hours
- Risk communication to executives and boards
- Compliance reporting for frameworks requiring severity-based remediation
- Integration with vulnerability management platforms (Qualys, Tenable, Rapid7)
Limitations of CVSS
While CVSS is a powerful tool, it has recognized limitations. The Base Score does not consider asset criticality, threat intelligence, or the likelihood of exploitation in a specific environment. Two vulnerabilities with identical CVSS scores may pose radically different risk levels depending on whether they are exposed to the internet, whether exploit code is actively used in the wild, or how critical the affected system is to the organization.
This is why security practitioners increasingly combine CVSS with EPSS (Exploit Prediction Scoring System), threat intelligence feeds, and asset-based risk models to achieve truly risk-based vulnerability prioritization.
How CVSS Scores Are Assigned
CVSS scores are assigned by the vulnerability's discoverer, the affected vendor, or NVD analysts using the published specification. For CVEs in the NVD, NIST analysts review vendor-assigned CVSS scores and may modify them if the scoring does not align with the specification. Tools like this CVSS Calculator allow security researchers and analysts to independently calculate and verify scores using the CVSS v3.1 formula.