What Is CVSS? Scores, Metrics, and Severity Ratings

Last verified on Nov 8, 2026.

CVSS, the Common Vulnerability Scoring System, rates how severe a vulnerability is on a scale from 0.0 to 10.0. It is maintained by FIRST, and this entry covers version 4.0. A CVSS score tells you how bad exploitation would be in general, not whether anyone is exploiting it or whether it matters in your environment.

The Four Metric Groups

CVSS v4.0 is composed of four groups, according to FIRST's specification:

Base metrics split into exploitability (attack vector, attack complexity, attack requirements, privileges required, and user interaction) and impact on the vulnerable system and on any subsequent systems (confidentiality, integrity, and availability). The spec notes that the vulnerable system is typically a software application, operating system, module, or driver, while subsequent systems can also include human safety.

Reading a Vector String

The vector string is the compact record of the metrics. This is the specification's own example, a Base-only vulnerability:

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

It reads: network attack vector, low complexity, no attack requirements, high privileges required, no user interaction, low confidentiality and integrity impact and no availability impact on the vulnerable system, and no impact on subsequent systems. Adding /E:A marks Exploit Maturity as Attacked, a Threat metric.

Older records still use CVSS 3.1. NVD scores Log4Shell (CVE-2021-44228) as 10.0 Critical:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vectors from v3.1 and v4.0 are not interchangeable, so check the prefix before comparing scores.

The Severity Scale

FIRST maps any CVSS score to a qualitative rating. The ratings are optional to publish.

Read the Label on a Score

A number alone is ambiguous. FIRST's nomenclature says to label scores by the metrics used: CVSS-B for Base only, CVSS-BE for Base and Environmental, CVSS-BT for Base and Threat, and CVSS-BTE for all three. Assessment providers such as maintainers and NVD typically publish only Base scores, so the "10.0" you see on an advisory is almost always CVSS-B. Applying Threat and Environmental metrics is the consumer's job.

What CVSS Does Not Tell You

FIRST's specification says CVSS consumers should feed the score into a vulnerability management process that also weighs factors outside CVSS, such as regulatory requirements, customers affected, and financial loss. Exploitation is a separate question. The EPSS FAQ states that CVSS and EPSS measure different things, and that multiplying EPSS by a CVSS score does not compute probability times severity.

A workable triage order:

1. Is it in the CISA KEV catalog? Exploitation is confirmed, so act first.
2. What is its EPSS score? A high value suggests exploitation is likely soon.
3. Is the affected asset exposed to the internet, and does CVSS show a network attack vector with no privileges required?
4. Only then use the CVSS rating to order the rest.

For each CVE, the score depends on who published it. cve.now, a free vulnerability feed from Sazabi, takes the score from the CVE's publishing CNA first, then from the record's enrichment containers, then from NVD, GitHub, or ENISA, and records which provider supplied it. To get new advisories for your software, see new advisories.