The Common Vulnerability Scoring System (CVSS) is a standardized framework for rating the severity of software vulnerabilities on a scale from 0.0 to 10.0. Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a consistent language for communicating how severe a vulnerability is based on its technical characteristics, regardless of the specific product or environment affected.
The Common Vulnerability Scoring System, or CVSS, is the industry standard for assigning a severity score to software vulnerabilities. When you see a vulnerability rated "Critical (9.8)" in a security advisory, that number comes from CVSS.
Maintained by FIRST (Forum of Incident Response and Security Teams), CVSS evaluates vulnerabilities across multiple dimensions and produces a score between 0.0 (informational) and 10.0 (maximum severity). The National Vulnerability Database (NVD) attaches CVSS scores to over 200,000 CVE entries, making it the default severity language across the security industry.
CVSS scores are grouped into severity ratings:
The current version, CVSS v4.0, was released in November 2023 and introduced significant changes from v3.1. It restructured the scoring into four metric groups:
CVSS is the lingua franca of vulnerability management. Every scanner, advisory, and security report uses it. Understanding how it works (and where it falls short) is essential for building a security program that actually prioritizes the right things.
Here's what startups need to know:
For startups building a vulnerability management practice, the key is to use CVSS as one input among several, not as the sole decision-maker:
CVSS v4.0 restructured the scoring system into four metric groups (Base, Threat, Environmental, and Supplemental), replacing v3.1's three groups (Base, Temporal, Environmental). The biggest change is the Threat metrics group, which replaces the old Temporal group and more directly connects scoring to real-world exploit activity. V4.0 also added granularity to attack complexity, introduced supplemental metrics for additional context, and attempted to address score inflation. However, the transition is gradual, as many tools and databases still primarily report v3.1 scores.
Because it's inefficient and leads to alert fatigue. Research shows that only about 2.3% of vulnerabilities scored CVSS 7 or above are actually exploited in the wild. Treating all high-CVSS findings as equally urgent means your team spends significant effort on vulnerabilities that attackers will likely never target, while potentially delaying work on lower-scored vulnerabilities that are actively being exploited. A smarter approach combines CVSS with EPSS (which estimates exploitation probability) and CISA's KEV catalog (which confirms active exploitation) to focus remediation where it actually reduces risk.
A CVSS base score is derived from two sub-groups of metrics: Exploitability metrics and Impact metrics. Exploitability metrics evaluate how the vulnerability is attacked, including the attack vector (network, adjacent, local, or physical), attack complexity, privileges required, and whether user interaction is needed. Impact metrics measure the consequences of a successful exploit on confidentiality, integrity, and availability of the affected system. These metrics are combined using a mathematical formula that produces a score between 0.0 and 10.0. You can calculate scores using FIRST's official CVSS calculator at first.org/cvss/calculator.
