What Is Common Vulnerability Scoring System?
The Common Vulnerability Scoring System (CVSS) is an open standard maintained by FIRST that rates the technical severity of a software vulnerability on a scale from 0.0 to 10.0. It describes how bad a vulnerability could be, not how likely it is to be exploited.
Also known as:
How CVSS Scoring Works
A CVSS score is calculated from a set of metrics that describe a vulnerability, such as how it is reached, how complex the attack is, what privileges are needed and what happens to confidentiality, integrity and availability if it succeeds. In CVSS v4.0, the current version, metrics are grouped into four sets.
- Base. The intrinsic qualities of the vulnerability. This is the score most databases publish.
- Threat. How the picture changes based on whether exploitation is happening.
- Environmental. Adjustments for a specific organization's systems and controls.
- Supplemental. Extra context that does not change the score, such as whether an attack can be automated.
CVSS Severity Ratings
- None: 0.0
- Low: 0.1 to 3.9
- Medium: 4.0 to 6.9
- High: 7.0 to 8.9
- Critical: 9.0 to 10.0
Why CVSS Alone Is Not Enough for Prioritization
Most teams only ever see the base score, which ignores whether the vulnerable code is reachable in their application, whether it is being exploited in the wild and how important the affected system is. A large share of findings score High or Critical, so sorting a backlog by CVSS alone leaves teams with more "urgent" work than they can do.
That is why CVSS is usually combined with other signals: EPSS for the probability of exploitation, the CISA KEV catalog for confirmed exploitation, reachability analysis for whether the code can run and business context for impact.
CVSS vs Exploit Validation
A CVSS score is an estimate of theoretical impact. Exploit validation tests the actual path and shows evidence of what an attacker can do. Nullify uses validation to turn a severity estimate into proof. See how Nullify validates exploits instead of guessing.
Key Takeaways
- CVSS rates the technical severity of a vulnerability from 0.0 to 10.0.
- It measures potential impact, not the likelihood of exploitation.
- Base scores ignore your environment, so many findings look urgent at once.
- Combine CVSS with EPSS, KEV, reachability and business context to prioritize.
Read More About Common Vulnerability Scoring System
Exploit Validation
See Nullify in Action
Nullify replaces severity guesses with proof that an exploit works.