What is CVSS? The Common Vulnerability Scoring System, version 4.0 explained

The Common Vulnerability Scoring System (CVSS) is an open framework, owned by the Forum of Incident Response and Security Teams (FIRST), for describing a software vulnerability's technical characteristics and severity as a score from 0.0 to 10.0. Vendors and the National Vulnerability Database publish CVSS scores so patch teams can sort flaws by how damaging exploitation could be.

What changed in version 4.0

FIRST published CVSS v4.0 on 1 November 2023. The release refined the base metrics, simplified the threat metrics and added supplemental metrics, among them Automatable, Recovery and Value Density, along with safety values for operational technology and connected devices.

Version 4.0 has four metric groups: Base, Threat (formerly Temporal), Environmental and Supplemental. It also labels what a score includes: CVSS-B for Base alone, CVSS-BT with Threat, CVSS-BE with Environmental, and CVSS-BTE with all three. The ratings run None (0.0), Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0).

What CVSS does not tell you

NVD puts it directly: CVSS supplies a qualitative measure of severity and is not a measure of risk. A Base score says nothing about whether attackers are using the flaw or whether the affected asset is exposed in a given network.

CVE-2015-3306 shows the gap. A score contributed by CISA, shown on NVD as CISA-ADP, rates the ProFTPD flaw 10 Critical, while NVD's own assessment was still blank. The flaw reached the KEV catalog only on 8 October 2026, more than eleven years after NVD published it. Severity and the timing of exploitation are separate questions.

What a patch desk does with it

Use the Base score as the first sort across a large backlog, then adjust it. Environmental metrics let a team raise or lower a score for its own deployment, and the Threat group reflects characteristics that change over time, such as exploit maturity. When a score is quoted without its B, BT or BTE label, ask which groups it includes before it sets a deadline.

Pair the score with exploitation signals rather than letting it decide alone. A Critical score with no sign of exploitation is a candidate for the normal monthly cycle; a Medium score on a KEV-listed, internet-facing system is not. Also check the version: NVD stopped generating new CVSS v2.0 data on 13 July 2022, so older tool data may sit on a retired scale.

Where it appears on Daily CISO

Patch Tuesday lists Microsoft's CVSS score beside each tracked fix. The security glossary sets CVSS against KEV and EPSS, and must-patch shows the exploitation signals that should sit next to any severity score.

Related terms

Exploit Prediction Scoring System (EPSS), Known Exploited Vulnerabilities (KEV) catalog, Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE).