Skip to main content
Regulatory Council
Promotional banner for the pentest readiness checklist
Category: Risk Assessment & Analysis

Vulnerability Scoring (CVSS)

Also known as: CVSS, Common Vulnerability Scoring System
Simply put

The Common Vulnerability Scoring System (CVSS) is a standardized method for describing how severe a security weakness in an information system is, expressing that severity as a numerical value. It is designed to give organizations a consistent way to compare and prioritize security flaws. Importantly, CVSS is intended as a measure of severity rather than a complete measure of the risk a vulnerability poses in any given environment.

Formal definition

CVSS is a standardized framework that produces a qualitative measure of the severity of a security vulnerability by scoring it against a defined set of criteria and assigning a numerical value representing its severity. It is commonly used to support risk-based vulnerability management and prioritization, but according to NIST's National Vulnerability Database, CVSS is explicitly not a measure of risk; a CVSS severity score does not by itself account for organization-specific factors such as asset criticality, exploitability in a particular environment, compensating controls, or business context. Practitioners typically supplement CVSS scores with environmental and threat context to derive an organization-specific risk view. This entry addresses the general concept; specific scoring metrics, formulas, and version differences should be verified against the primary CVSS specification, as framework details evolve across editions.

Why it matters

Organizations frequently face far more identified vulnerabilities than they can remediate at once, and CVSS provides a common, standardized language for describing how severe each weakness is. This consistency allows security and risk teams to compare flaws across different systems and vendors using the same criteria, supporting more defensible prioritization decisions than ad hoc or subjective judgments would allow. For compliance and audit functions, a widely recognized scoring system also offers a transparent basis for documenting why certain vulnerabilities were treated as urgent while others were deferred.

The central caution, however, is that CVSS measures severity, not risk. According to NIST's National Vulnerability Database, CVSS is explicitly not a measure of risk. A high CVSS score does not by itself establish that a given vulnerability poses a high risk to a particular organization, because the score does not account for asset criticality, whether the flaw is actually exploitable in that environment, the presence of compensating controls, or broader business context. Treating CVSS scores as a complete risk ranking can therefore lead to misallocated remediation effort, over-investing in high-scoring flaws on low-value or well-protected assets while under-weighting lower-scoring flaws on business-critical systems.

For governance and risk management purposes, CVSS is best understood as an input to a risk-based vulnerability management process rather than the process itself. Practitioners typically layer environmental and threat context on top of the base severity score to derive an organization-specific view of risk. Recognizing this distinction helps organizations avoid conflating a standardized severity indicator with an actual assessment of the risk a vulnerability poses to their own objectives.

Who it's relevant to

Risk Managers
CVSS provides a standardized severity input that supports risk-based vulnerability prioritization, but risk managers must combine it with asset criticality, exploitability, compensating controls, and business context to translate severity into an organization-specific view of risk. Relying on CVSS scores alone would conflate severity with risk, which the framework's own guidance cautions against.
Security and Vulnerability Management Teams
Teams responsible for identifying and remediating security weaknesses use CVSS to compare flaws consistently across systems and vendors and to help sequence remediation. They typically layer environmental and threat context onto base scores to ensure remediation effort is directed toward vulnerabilities that matter most in their specific environment.
Internal Auditors and Compliance Officers
A widely recognized scoring system offers a transparent, documentable basis for evaluating how an organization prioritizes and treats identified vulnerabilities. Auditors and compliance professionals should understand that a CVSS score reflects severity, not risk, when assessing whether remediation decisions are appropriately justified against organization-specific factors.
General Counsel and Governance Leaders
Those overseeing organizational risk posture benefit from understanding CVSS as one standardized input to vulnerability management rather than a complete risk assessment. This distinction is relevant when evaluating the adequacy of a vulnerability management program and the defensibility of prioritization decisions.

Inside CVSS

Base Metric Group
The core, relatively stable characteristics of a vulnerability that do not change over time or across environments. This group typically captures aspects such as how the vulnerability is exploited (attack vector, attack complexity, required privileges, and user interaction) and its potential effect on confidentiality, integrity, and availability. It produces a base score commonly expressed on a 0 to 10 scale.
Temporal Metric Group
Metrics that adjust the base score to reflect characteristics that may change over time, such as the availability of exploit code, the state of remediation (for example, whether a patch or workaround exists), and the level of confidence in the vulnerability report. These are optional refinements layered on top of the base score.
Environmental Metric Group
Metrics that allow an organization to tailor the score to its specific context, reflecting the importance of the affected asset and any mitigating or aggravating conditions in the deployment environment. This supports organization-specific prioritization rather than a one-size-fits-all rating.
Numeric Score and Severity Rating
CVSS produces a numeric score, typically on a 0 to 10 scale, that is often mapped to qualitative severity labels such as low, medium, high, or critical. The specific mapping bands and score formulas have varied across CVSS versions, so the version should be identified when citing a score.
Vector String
A compact, human- and machine-readable representation of the metric values selected to produce a given score. It documents the assumptions behind a score and supports transparency and reproducibility when the rating is reviewed or recalculated.

Common questions

Answers to the questions practitioners most commonly ask about CVSS.

Does a high CVSS base score mean a vulnerability is an urgent risk to our organization?
Not necessarily. The CVSS base score reflects the intrinsic, context-independent characteristics of a vulnerability and is not, on its own, a measure of risk to a specific organization. A base score does not account for whether the affected asset exists in your environment, how exposed it is, what compensating controls are in place, or the business value at stake. In risk-management terms, the base score is closer to a component of inherent severity than to residual risk. Many practitioners apply the temporal and environmental metric groups, or supplement CVSS with threat intelligence and asset context, to arrive at a prioritization decision. Treating the base score as a standalone risk rating is a common misapplication.
Is CVSS the same thing as a complete vulnerability risk assessment?
No. CVSS is a scoring system that produces a numerical severity rating for a given vulnerability; it is not a full risk assessment methodology. A risk assessment generally considers the likelihood of exploitation in your specific threat environment, the value and criticality of affected assets, potential business impact, and the effect of existing controls, dimensions that a base score does not capture. CVSS can serve as one input to that broader process, but relying on it as the sole determinant of treatment priority conflates a severity measure with a risk decision. Where a term or output has context-dependent meaning, that distinction should be made explicit in your own methodology.
Which CVSS metric groups should we actually use when prioritizing remediation?
CVSS is typically structured into base, temporal, and environmental metric groups. The base group captures intrinsic characteristics and is often the score published in advisories. Many programs then apply the environmental metrics to reflect their own asset context and any modifying factors, and may use temporal or threat-related metrics to account for the current state of exploitation and remediation availability. Using only the base score is common but tends to overstate or understate priority relative to your environment. The appropriate combination depends on the maturity of your program and the data available; document which groups you apply so scoring is consistent and defensible.
How should CVSS scores feed into remediation timelines or service-level targets?
A common convention is to map severity bands derived from CVSS scores to internal remediation timeframes, so that higher-severity findings receive faster attention. To make such mapping defensible, organizations often adjust the raw score with environmental context and asset criticality before assigning a timeline, and they align the bands with their risk appetite and any applicable regulatory or contractual obligations. It is generally advisable to treat these timelines as a policy commitment rather than a fixed property of CVSS itself, and to allow documented exceptions where compensating controls modify the residual risk. Timelines and their governance vary by sector, jurisdiction, and organization size.
How do we keep CVSS-based prioritization current as circumstances change?
Because a vulnerability's real-world significance can change, through the emergence of exploit code, shifts in threat activity, or the availability of a fix, prioritization based solely on a static base score can become stale. Programs often address this by periodically re-evaluating scores using temporal or threat-related metrics, incorporating current threat intelligence, and re-assessing environmental factors when the asset landscape changes. Establishing a defined cadence and clear triggers for re-scoring supports consistency. The frequency appropriate to your organization depends on the pace of change in your environment and the criticality of affected systems.
How can we apply CVSS consistently across teams and produce defensible, auditable scores?
Consistency generally comes from documenting how your organization interprets and applies each metric, particularly the environmental metrics that require judgment about your context, so that different analysts reach comparable results for similar findings. Recording the metric values selected, the rationale, and the CVSS version used supports auditability and helps demonstrate a repeatable process to internal audit or external assessors. It is also useful to note where CVSS output is adjusted by additional factors outside the standard, so the boundary between the published scoring system and your organization's overlay is clear. Governance ownership of the scoring methodology helps maintain consistency over time.

Common misconceptions

A CVSS score by itself tells you how much risk a vulnerability poses to your organization.
CVSS, particularly the base score, is a measure of a vulnerability's technical severity, not a complete risk assessment. Organizational risk also depends on factors such as asset criticality, exposure, threat activity, and compensating controls. The temporal and environmental groups exist to incorporate some of this context, but even a fully adjusted score is one input to risk prioritization rather than a definitive risk figure.
A high CVSS score means a vulnerability is being actively exploited and must always be the top remediation priority.
The base score reflects potential severity, not the likelihood of exploitation in the wild. Whether exploit code exists or is being used is addressed by temporal metrics and is often supplemented by separate threat and exploit-availability information. Prioritization typically combines severity with exploitation likelihood and business context rather than relying on the base score alone.
CVSS scores are directly comparable regardless of which version produced them.
The metrics, formulas, and severity bands have changed across CVSS versions. Scores generated under different versions are not always directly comparable, so the version should be recorded and considered when interpreting or trending scores over time.

Best practices

Record the CVSS version and the full vector string alongside any score, so the assumptions behind a rating are transparent and the score can be reviewed or recalculated.
Treat the base score as a starting point and apply temporal and environmental metrics to reflect exploit availability, remediation status, and the criticality of the affected asset in your environment.
Combine CVSS severity with exploitation and threat intelligence and with business context when prioritizing remediation, rather than sequencing work by base score alone.
Establish and document your organization's own mapping from scores to remediation timelines or actions, and align it with your risk appetite and any applicable regulatory or contractual obligations.
Verify scores against the authoritative source or vendor advisory for a given vulnerability, and be cautious when comparing or trending scores produced under different CVSS versions.
Integrate CVSS-based prioritization into a broader vulnerability management process that includes retesting and validation after remediation, recognizing that a control or patch modifies risk rather than eliminating it entirely.
Promotional banner for the Pentest Readiness checklist download