When a new vulnerability in software is discovered, the immediate question arises: how serious is this, really? Is it a problem that needs to be resolved today, or can it wait until the next maintenance cycle? To answer that question in a structured and consistent way, the Common Vulnerability Scoring System exists, better known as CVSS. In this article you will learn what CVSS is, how the score is calculated, what the severity categories mean, and how to apply CVSS wisely within your own security practice.
We build the knowledge step by step: from the origin of the system, through the technical workings, to the practical application. By the end, you will understand not only what a CVSS score says, but also what it does not say, and why that distinction is crucial for good cybersecurity.
What is CVSS and where does it come from?
The Common Vulnerability Scoring System is an open standard for assessing the severity of vulnerabilities in software and systems. The system provides a standardized way to compare vulnerabilities, regardless of the type of system or vendor where they were found.
CVSS was developed by the Forum of Incident Response and Security Teams (FIRST) and was first published in 2005. Since then, the system has been revised several times. The most widely used version is CVSS 3.1, but CVSS 4.0 is now available and introduces further refinements for more modern IT environments. The scores are published through the National Vulnerability Database (NVD) of the US government, which maintains a CVSS score for virtually every known vulnerability.
The goal of CVSS is simple: to provide a common language so that security teams, vendors, and organizations around the world can discuss the severity of a vulnerability in the same way. Without such a standard, every party would use its own measuring stick, making comparison and prioritization virtually impossible.
How does the CVSS score work and what do the base metrics measure?
A CVSS score is a number between 0.0 and 10.0, where a higher score indicates a more severe vulnerability. That score is calculated based on a set of metrics, divided into three groups: the base metrics, the temporal metrics, and the environmental metrics. The base metrics form the foundation and are applied most consistently.
The base metrics: what is being measured?
The base metrics describe the intrinsic characteristics of a vulnerability, independent of the specific context of an organization. They are divided into two categories:
- Exploitability: How easy is the vulnerability to exploit? This includes factors such as the attack vector (does the attacker need to be on the network, or can it be done via the internet?), the complexity of the attack, and whether special privileges or user interaction are required.
- Impact: What is the potential damage if the vulnerability is exploited? This is measured along three axes: confidentiality (can data be viewed?), integrity (can data be modified?), and availability (can the system be disrupted?).
A concrete example: a vulnerability that can be exploited remotely without authentication and grants full access to a system scores high on virtually all base metrics. A vulnerability that can only be exploited locally and exposes only limited information scores considerably lower.
Temporal and environmental metrics
In addition to the base metrics, there are temporal metrics that take into account the current exploitation status of a vulnerability. Is there already a working exploit available? Does a patch exist? These factors can adjust the effective score up or down. The environmental metrics go one step further and allow organizations to adjust the score based on their own IT environment and the value of the affected systems. For more depth on how vulnerabilities are tested in practice, it is useful to understand how a professional pentest works.
What do the severity categories mean in practice?
The numerical CVSS score is translated into five severity categories, which help with quickly assessing priority:
- None (0.0): No vulnerability or negligible risk.
- Low (0.1 – 3.9): Limited impact; exploitation is difficult or has few consequences.
- Medium (4.0 – 6.9): Moderate impact; exploitation requires specific circumstances.
- High (7.0 – 8.9): Serious vulnerability with significant potential damage.
- Critical (9.0 – 10.0): Maximum severity; immediate action required.
In practice, security teams use these categories as a first filter when prioritizing patches. A Critical vulnerability in a publicly accessible system typically receives the highest priority and requires swift action. A Low vulnerability in an internal system without sensitive data can be included in the regular maintenance cycle.
It is important to realize, however, that the severity category is a starting point, not a final verdict. The actual urgency always depends on the broader context, such as which system is involved, who has access to it, and how the system is connected to the rest of your environment.
Why is a high CVSS score not always the greatest danger?
This is perhaps the most important lesson you can take away from this article: a high CVSS score does not automatically mean that a vulnerability poses the greatest risk to your organization. And conversely, a low score can sometimes be misleading.
CVSS measures the severity of a vulnerability in isolation. The system does not account for the way vulnerabilities can be combined into an attack path. An attacker who has access to a system does not always need to exploit the most critical vulnerability. Sometimes a combination of a medium-score vulnerability, an incorrect permission setting, and a misconfiguration in the cloud is together more dangerous than a single standalone Critical vulnerability.
Consider the following: a poor-quality lock on a back door that nobody uses is less urgent than a slightly better lock on the front door that is always left open. CVSS tells you how bad the lock is, but not which door is most attractive to a burglar. For that insight you need a broader perspective, such as that provided by red team exercises or in-depth security research.
A common mistake is simply working through all vulnerabilities in order of CVSS score. You can resolve twenty Medium vulnerabilities and still remain exposed, because the combination of remaining low-score findings together forms a working attack path.
Applying CVSS within your own vulnerability management
Building on an understanding of what CVSS measures and what it does not measure, the next step is: how do you use the system effectively in practice? CVSS is an excellent tool when you treat it as one input in a broader assessment, not as the sole measure.
Effective vulnerability management based on CVSS works as follows:
- Start with the base metrics as a filter: Use the CVSS score to create an initial prioritization. Critical and High vulnerabilities deserve prompt attention, especially if they are present in publicly accessible systems.
- Add context: Ask yourself which system is involved, how sensitive the data it processes is, and how the system is connected to the rest of your environment. A Critical vulnerability in an isolated test system is less urgent than a Medium vulnerability in your customer database.
- Look at attack paths, not just individual findings: Analyze how vulnerabilities can be combined. Are there combinations of low and medium vulnerabilities that together form a serious risk?
- Keep an eye on the temporal metrics: If there is an active exploit in circulation for a vulnerability, that significantly increases the urgency, even if the base score is not extremely high.
- Ensure continuous monitoring: Your environment changes constantly. New systems are added, configurations change, new vulnerabilities are discovered. A one-time assessment is therefore always just a snapshot in time. See how continuous security monitoring can help with this.
The goal is not to remediate every vulnerability with a high CVSS score first, but to identify the vulnerabilities that pose the greatest actual risk to your organization.
How Q-Cyber helps with assessing vulnerabilities
CVSS provides a valuable standard for assessing the severity of vulnerabilities, but it does not tell the full story. At Q-Cyber we understand that the real threat often does not lie in a single high score, but in the combination of vulnerabilities, misconfigurations, and permissions that together form an attack path.
This is how we help organizations go beyond the CVSS score alone:
- Our ethical hackers perform manual pentests that go beyond automated vulnerability scans, and discover attack paths that tools structurally miss.
- We translate technical findings into concrete priorities, so you know exactly which action has the greatest impact.
- Through our Continuous-Q program, we keep your security up to date throughout the year, not just on the day of the test.
- We provide independent advice, without dependency on software vendors or other suppliers.
Want to know how vulnerable your organization truly is and which risks deserve priority? Contact us for a no-obligation conversation.