Simple definition
Common Vulnerability Scoring System; a scoring method used to rate the severity of vulnerabilities.
CVSS helps organizations use a common technical language for vulnerability severity. It is best treated as one input to risk-based vulnerability management rather than a complete remediation priority on its own.
What does CVSS measure?
Base metrics
Describe intrinsic technical characteristics of the vulnerability.
Threat metrics
Adjust severity using current threat characteristics defined by the framework.
Environmental metrics
Allow organizations to tailor severity to their own environment.
Supplemental metrics
Provide additional contextual attributes that support interpretation.
Numerical score
Produces a standardized severity score.
Severity rating
Scores can be expressed as qualitative categories such as Low, Medium, High, and Critical.
Why CVSS matters
- A standardized framework helps vendors, scanners, and customers discuss severity using the same metric definitions.
- CVSS makes the technical characteristics behind a score visible.
- Environmental context can help adapt technical severity to the importance of a specific deployment.
- A high CVSS score does not automatically mean a vulnerability is actively exploited.
- A lower-severity vulnerability can still deserve urgent remediation on a critical asset or attack path.
- Organizations should combine CVSS with exploitability and business context instead of score thresholds alone.
How CVSS works
Identify the vulnerability
Use the CVE, vendor advisory, or product finding to understand the affected component.
Evaluate technical characteristics
Assess the metrics defined by the applicable CVSS version.
Calculate the score
Use the specification or supported calculator to derive standardized severity.
Add threat and environmental context
Incorporate current threat information and organization-specific conditions where appropriate.
Combine with risk context
Add EPSS, KEV, internet exposure, asset criticality, and business service.
Prioritize and track
Use the combined context to create remediation queues, SLAs, exceptions, and reporting.
CVSS concepts vulnerability teams should understand
CVSS v4.0
The current FIRST specification separates Base, Threat, Environmental, and Supplemental metric groups.
Base score
Represents severity from intrinsic vulnerability characteristics under the framework's assumptions.
Threat context
Reflects current threat-related characteristics.
Environmental context
Tailors severity to a deployed environment and affected-system importance.
Vector string
A compact representation of the metric selections behind the score.
Qualitative severity
Maps numerical results into severity categories for easier interpretation.
Common CVSS use cases
Vulnerability scanners
Display standardized severity beside discovered vulnerabilities.
Vulnerability Response
Set initial remediation queues or SLAs before additional context is applied.
Product security
Communicate severity in advisories.
Software risk
Enrich software-component vulnerabilities with technical severity.
Risk reporting
Support standardized technical severity reporting.
Vulnerability triage
Combine CVSS with EPSS, KEV, exposure, and criticality to determine priority.
CVSS vs EPSS vs Asset Criticality
| Signal | Primary question | What it measures |
|---|---|---|
| CVSS | How severe are the technical characteristics? | Standardized technical severity. |
| EPSS | How likely is the CVE to be exploited soon? | Predicted exploitation probability within the EPSS prediction window. |
| Asset Criticality | How important is the affected system? | Business, operational, compliance, and service importance. |
Key technical considerations
Track CVSS version
A v3.1 vector and a v4.0 vector are not interchangeable.
Store the vector
The metric vector explains how the score was derived.
Track score source
Vendor, scanner, and internal assessments can differ; preserve provenance.
Use environment context thoughtfully
Technical severity can change in importance based on mitigations and asset characteristics.
Avoid score-only automation
Do not let one number override known exploitation or critical assets.
Validate mappings
Ensure connectors preserve version, vector, and metric data.
Benefits and common problems
Benefits
- Standardized severity language.
- Transparent metric-based scoring.
- Broad support across vulnerability tools.
- Useful input for SLAs and triage.
- Versioned framework for consistent reporting.
Common problems
- Treating severity as the same thing as risk.
- Mixing CVSS versions without metadata.
- Discarding the vector and keeping only the number.
- Automating remediation priority solely from CVSS.
- Ignoring exploitation or asset importance.
How ForshTec helps operationalize CVSS
ForshTec integrates CVSS with vulnerability scanners, EPSS, KEV, asset context, and ServiceNow remediation workflows so severity becomes one governed input to prioritization.
- CVSS score and vector mapping
- CVSS-version preservation
- Scanner integrations
- EPSS and KEV enrichment
- Asset-criticality correlation
- Risk-based remediation workflows
Need vulnerability severity connected to real remediation priority?
ForshTec can preserve CVSS correctly across integrations and combine it with exploitability, asset, and workflow context.
Talk to ForshTecFAQs
What does CVSS stand for?
Common Vulnerability Scoring System.
What does a CVSS score measure?
The technical severity of a vulnerability using standardized metrics; it is not a complete measure of organizational risk.
What is the CVSS score range?
CVSS numerical severity scores are represented on a 0.0 to 10.0 scale.
What is the current CVSS version?
CVSS v4.0 is the current FIRST specification. Existing data and tools may still contain older versions such as v3.1.
How is CVSS different from EPSS?
CVSS measures technical severity, while EPSS estimates exploitation probability.
Should CVSS determine patch priority by itself?
No. Programs should also consider known exploitation, EPSS, exposure, asset criticality, business impact, controls, and remediation feasibility.