What is CVSS?
CVSS (Common Vulnerability Scoring System) is a standardized framework for rating the severity of security vulnerabilities, producing a 0–10 score used to prioritize remediation efforts.
- 1.Definition
- 2.CVSS Score Components
- 3.CVSS Severity Ratings
- 4.CVSS 4.0
- 5.Limitations of CVSS
Definition
CVSS — Common Vulnerability Scoring System — is an open framework for communicating the characteristics and severity of software vulnerabilities. It produces a numerical score from 0 to 10 that represents the severity of a vulnerability, allowing security teams to prioritize remediation efforts based on a consistent, standardized scale.
CVSS is maintained by FIRST (Forum of Incident Response and Security Teams). NVD (National Vulnerability Database) applies CVSS scores to CVE entries, making CVSS scores the primary severity signal in vulnerability management tools worldwide.
CVSS Score Components
CVSS 3.1 (the current widely adopted version) calculates a score from three metric groups:
Base Score
Captures the intrinsic characteristics of the vulnerability — properties that are constant regardless of environment or time:
- Attack Vector (AV) — Network, Adjacent, Local, Physical
- Attack Complexity (AC) — Low or High
- Privileges Required (PR) — None, Low, High
- User Interaction (UI) — None or Required
- Scope (S) — Unchanged or Changed
- Confidentiality Impact (C) — None, Low, High
- Integrity Impact (I) — None, Low, High
- Availability Impact (A) — None, Low, High
Temporal Score
Adjusts the Base Score based on time-sensitive factors: whether exploit code is available, whether a fix exists, and how confident researchers are in the vulnerability report. The Temporal Score decreases over time as patches are released.
Environmental Score
Allows organizations to customize the score based on their specific environment: which security controls are in place, how important the affected system is, and how much impact a breach would have in their context. Environmental scoring enables context-specific prioritization.
CVSS Severity Ratings
| Score Range | Severity | Typical Response Time |
|---|---|---|
| 0.0 | None | No action required |
| 0.1 – 3.9 | Low | Address in normal maintenance cycle |
| 4.0 – 6.9 | Medium | Plan remediation within 90 days |
| 7.0 – 8.9 | High | Remediate within 30 days |
| 9.0 – 10.0 | Critical | Remediate immediately — hours to days |
CVSS 4.0
CVSS 4.0 was released in 2023 and introduces significant improvements:
- New metric groups: Supplemental (for informational context) and Threat (replacing Temporal)
- More granular attack complexity differentiation
- Better handling of vulnerabilities in OT/ICS/IoT contexts
- Improved scoring for vulnerabilities requiring subsequent system exploitation
Adoption of CVSS 4.0 is gradual — NVD and most tools continue to publish CVSS 3.1 scores, with 4.0 adoption increasing through 2025-2026.
Limitations of CVSS
CVSS is widely used but has well-documented limitations:
- Base Score does not reflect exploitability in practice — a CVSS 9.8 vulnerability with no public exploit and no affected surface in your environment may be lower priority than a CVSS 7.0 with active exploitation
- Base Scores are assigned by CVE reporters who may have different standards — scores are not perfectly consistent across CNAs
- CVSS does not account for the business context of the affected system — a critical system and an internal dev tool get the same score for the same vulnerability
- Score inflation — many vulnerabilities receive 9+ scores, making differentiation within the Critical band difficult
CVSS tells you how bad a vulnerability could be in the worst case. EPSS tells you how likely it is to be exploited. You need both — and your environment context — to make good prioritization decisions.
- Hydra Security Research, Autonomous Code Governance
CVSS and Autonomous Code Governance
Hydra uses CVSS Base Scores as the starting point for vulnerability prioritization, enriched with EPSS (Exploit Prediction Scoring System) data on actual exploitation probability and environmental context from the codebase. High-CVSS vulnerabilities trigger autonomous remediation by default; lower-severity findings are batched and scheduled. For critical (9.0+) vulnerabilities in dependencies, Hydra generates upgrade PRs within the hour of NVD enrichment. Environmental scoring adjustments — accounting for compensating controls already present in the codebase — refine priorities further.
Frequently Asked Questions
Should I prioritize all CVSS Critical (9.0+) vulnerabilities first?
CVSS Base Score is a starting point, not a complete prioritization signal. A CVSS 9.8 vulnerability in a library not reachable from untrusted input may be lower priority than a CVSS 7.5 vulnerability in an externally-exposed API endpoint. Combine CVSS with EPSS (exploitation probability), reachability analysis, and business context for accurate prioritization.
What is EPSS and how does it relate to CVSS?
EPSS (Exploit Prediction Scoring System) is a complementary scoring system that estimates the probability that a specific CVE will be exploited in the wild within 30 days. Where CVSS measures potential severity, EPSS measures exploitation likelihood. Research shows that only a small fraction of high-CVSS vulnerabilities are ever exploited. Using CVSS + EPSS together significantly improves prioritization accuracy.
Why do different scanners report different CVSS scores for the same CVE?
CVSS scores may differ between tools for several reasons: different tools may use different CVSS versions (2.0, 3.0, 3.1, 4.0), vendor-assigned scores may differ from NVD-assigned scores, and Environmental Score adjustments applied by your organization change the reported score. Always check the score version and source when comparing across tools.
Stop flagging. Start fixing.
Hyrax reviews your pull requests, remediates issues autonomously, and closes the ticket.
Join the waitlist