CVSS

CVSS, the Common Vulnerability Scoring System, is the open standard that expresses the severity of a software vulnerability as a number from 0.0 to 10.0. It is maintained by FIRST and used by virtually every vendor, scanner and vulnerability database.

What it means

The number you see quoted everywhere is the base score. It is calculated from fixed properties of the vulnerability itself. On the exploitability side sit the attack vector (network, adjacent network, local or physical), the attack complexity, the privileges required and whether user interaction is needed. In v3.1, scope also counts: does the attack reach beyond the vulnerable component itself? The impact side consists of the three CIA properties: confidentiality, integrity and availability. Every one of those choices is published as a vector string, so you can check where a number came from. Each number also carries a label: 0.0 is none, 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high and 9.0 to 10.0 critical.

Base, temporal and environmental are three different things. The temporal score (renamed to threat metrics in v4.0) adjusts for the current state of play, such as whether public exploit code exists. The environmental score lets you retune the metrics for your own estate. In practice almost everyone publishes the base score alone, and that score is deliberately context-free.

CVSS v3.1 is the most widely used version, and older records still carry v2 or v3.0 scores. The newer v4.0 adds attack requirements, replaces scope with separate impact metrics for the vulnerable system and for subsequent systems, and introduces supplemental metrics. Never compare two numbers without knowing which version produced them.

Why it matters

A base score describes the vulnerability, not your risk. The formula does not know whether the affected system faces the internet, what data it holds or how critical it is to your operations. A 9.8 on an isolated test machine can be less urgent than a 6.5 on a publicly reachable production server.

Combine the score with your asset inventory and with sources that report real-world exploitation, such as the CISA KEV catalog.

Example

The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields a base score of 9.8: attackable over the network, no privileges, no user interaction and full impact on all three CIA properties. That identical number applies to a locked-down internal tool and to a public web server alike. The difference in urgency is yours to supply.