Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is CVSS? The scoring system explained

In one sentence: CVSS is a standard 0 to 10 score that tells you how severe a software flaw is in general, so you can compare flaws, but not how much risk it poses to your business.

What it is

FIRST, the non-profit that owns it, describes CVSS as an open framework for communicating the characteristics and severity of software vulnerabilities. Scores like this appear in many scanner reports and vendor advisories.

Version 4.0 has four metric groups: Base, Threat, Environmental and Supplemental. Base values combine to produce a score from 0 to 10. The score should be published with its vector string, a short code showing how it was worked out.

How it works

  1. The scorer rates the flaw’s intrinsic traits. Base metrics include how the attacker reaches it (network or local), how complex it is, whether privileges or user interaction are needed, and the impact on confidentiality, integrity and availability.
  2. The Base score assumes the reasonable worst case. FIRST’s FAQ explains vendors score this way, and that Base scores are not meant to stand alone.
  3. Threat metrics adjust for time-changing facts, such as whether exploit code exists or attacks are happening.
  4. Environmental metrics adjust for your setting, such as existing protections and how critical the system is.
  5. The result is a number and a vector, for example one of the official worked examples that begins CVSS:4.0/AV:N/AC:L.

What it does not do: it does not tell you whether anyone is attacking the flaw today, or how bad it would be for your business. FIRST says Base scores measure severity and should not be used alone to assess risk.

Who it affects and how badly

Anyone who reads a scan report or a patch bulletin: IT managers, MSPs, auditors and insurers. Small firms often see only the headline score. Mid-sized firms with vulnerability scanning get long lists ranked by CVSS. Regulated businesses are asked by auditors how they prioritise.

Misuse causes real problems. Ranking only by score can bury a “medium” flaw that attackers are actively using, and waste time on a “critical” one that is not reachable in your setup. Cyber Essentials uses a score as a trigger. As summarised by a Cyber Essentials requirements guide, updates should be applied within 14 days where they fix critical or high-risk flaws or have a CVSS v3 Base score of 7 or above.

Real examples

CISA’s KEV guidance. CISA says the Known Exploited Vulnerabilities catalogue exists because severity scores alone miss what attackers are actually doing, and it recommends using KEV as one input to a prioritisation framework rather than the only criterion. Source: https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities-revoked

FIRST worked examples. FIRST publishes official scored examples, including a pair of chained flaws that it combines into one vector. Source: https://www.first.org/cvss/v4.0/user-guide

No single incident defines CVSS, so there is no named victim here.

How to detect it

CVSS is not something you detect, but you can check you are using it well.

  • Open your scan or patch report and find the vector string behind each score. If only a number is shown, ask the tool or vendor for the vector.
  • Check which version appears (3.1 or 4.0). They are not directly comparable.
  • Cross-check high scores against the CISA KEV catalogue and your own asset list.
  • In Microsoft Defender Vulnerability Management or your scanner, filter on internet-facing assets and exploit availability, not on score alone.

How to fix or prevent it

  1. Keep an asset list, so you know which flawed software you actually run and where.
  2. Prioritise flaws that are being exploited first. Use the CISA KEV catalogue as an input.
  3. Add context. Raise priority for internet-facing systems and sensitive data, and lower it where a flaw is not reachable.
  4. Patch critical and high flaws inside your agreed window. Cyber Essentials uses 14 days.
  5. Record why you accepted any delay.
  6. Re-score or re-check when new threat information appears.
  7. Test your real exposure with a manual penetration test, because scores describe flaws, not your network.

Related terms

Browse all entries in the vulnerabilities hub.

FAQ

What does a CVSS score of 9.8 mean? It means the flaw is rated very severe in general. FIRST says the Base score alone should not be used to assess your risk.

Is CVSS the same as risk? No. FIRST says Base scores measure severity only and should not be used alone to assess risk.

Which version is current? FIRST publishes CVSS v4.0. Many reports still show v3.1, and the two are not directly comparable.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.