CVSS Scores Explained: How Vulnerability Severity Is Rated

Almost every vulnerability report, scanner result and advisory includes a CVSS score. The Common Vulnerability Scoring System, maintained by FIRST, gives a consistent way to describe how severe a vulnerability is. Testers use it to rate findings; defenders use it to prioritize. Understanding how it works helps you use it properly.

The Scale

• 0.0: none
• 0.1 to 3.9: low
• 4.0 to 6.9: medium
• 7.0 to 8.9: high
• 9.0 to 10.0: critical

What Goes into a Base Score

The base score describes the vulnerability itself, using a short set of metrics:

• Attack vector: network, adjacent network, local, or physical access needed
• Attack complexity and requirements: how hard the conditions are to meet
• Privileges required: none, low or high
• User interaction: whether a user must do something, such as click a link
• Impact: on confidentiality, integrity and availability of the vulnerable system and of other systems

The metrics are written as a vector string, such as "CVSS:4.0/AV:N/AC:L/…", so anyone can see how the score was reached.

What Changed in CVSS v4.0

FIRST published CVSS v4.0 in November 2023, replacing v3.1. It splits impact into the vulnerable system and subsequent systems, adds an "attack requirements" metric, and introduces threat metrics (such as whether exploitation has been seen) and supplemental metrics. Scores are labeled by what they include: CVSS-B for base only, CVSS-BT with threat, CVSS-BE with environmental, and CVSS-BTE with both. You will still see many v3.1 scores, so always note which version a score uses.

Why a Score Alone Is Not Enough

• The base score ignores your environment: the same flaw is more urgent on an internet-facing server than on an isolated test box
• It does not say whether attackers are actively exploiting the flaw; catalogs of known exploited vulnerabilities and exploit-prediction scores help here
• It rates one flaw at a time, while real attacks chain several low and medium findings

Using CVSS in a Report

Give each finding a score and its vector, but also explain in plain language why it matters to this client, and order fixes by real risk. A clear attack path showing how three medium findings lead to domain admin is more persuasive than any single number. See how to write a penetration testing report.

Learning to Rate Findings

Our penetration testing courses (network and Active Directory, application security) teach you to rate findings with CVSS v4 and explain the business risk in your reports. See a sample graded report.