What is CVSS Score (CVSS)?
CVSS Score (CVSS) is a standardized numeric rating, from 0.0 to 10.0, that describes the severity of a software vulnerability. It is maintained by FIRST (Forum of Incident Response and Security Teams) and used by security teams worldwide to compare and prioritize vulnerabilities.
What it is
CVSS Score (CVSS) is an open framework for rating the severity of security vulnerabilities. The score is calculated from a set of metrics grouped into three categories:
- Base metrics: Intrinsic properties of the vulnerability, such as attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction needed, and the impact on confidentiality, integrity, and availability.
- Temporal metrics: Properties that change over time, such as whether a public exploit exists and whether a patch is available.
- Environmental metrics: Adjustments a specific organization makes to reflect their own infrastructure and risk tolerance.
The resulting score maps to a qualitative label: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), or Critical (9.0–10.0). CVSS is currently on version 3.1, with version 4.0 published in 2023.
Why it matters
Without a common scale, two teams looking at the same vulnerability might reach different conclusions about urgency. CVSS gives vendors, researchers, and defenders a shared language. The National Vulnerability Database (NVD) publishes a CVSS score for every CVE it records, so the score is often the first data point a security team sees when a new vulnerability is disclosed. Teams use it to decide which patches to apply first and to report risk to management in a consistent way.
How tools address it
Vulnerability assessment tools such as OpenVAS, RoboShadow, and Orca Cloud Vulnerability Management ingest CVSS scores from the NVD and from vendor advisories, then display them alongside scan findings. Unified vulnerability management platforms go further: they combine the CVSS base score with asset context, reachability data, and threat intelligence to produce a prioritized remediation queue. Threat and vulnerability management programs use CVSS as a baseline metric, then layer on additional signals to decide what to fix first.