When a security scanner reports a vulnerability with a CVSS score of 9.8, alarm bells start ringing at many organizations. Understandable, as such a high score suggests a critical risk. But does a score of 9.8 automatically mean your organization is in great danger? Not necessarily. The CVSS score tells you something about the severity of a vulnerability in general, but says little about the actual risk you face in your specific situation.
In this article, we explain step by step what a CVSS score exactly is, how it is calculated, and why it is only one piece of a much larger puzzle. We build from the basic principles to practical tools for prioritizing vulnerabilities based on actual risk, not just a number.
What is a CVSS score and how is it calculated?
CVSS stands for Common Vulnerability Scoring System and is a standardized method for assessing the severity of a security vulnerability. The system assigns scores from 0.0 to 10.0, with a higher score indicating a more severe vulnerability. CVSS is used worldwide by security teams, software vendors, and auditors as a common language for risk assessment.
The score is calculated based on a series of metrics, divided into three groups:
- Base Score: The inherent properties of the vulnerability itself, such as how easy it is to exploit, whether authentication is required, and what impact a successful attack has on confidentiality, integrity, and availability.
- Temporal Score: Factors that change over time, such as whether a public exploit is already available and whether a patch exists.
- Environmental Score: Adjustments based on the specific environment of an organization, such as how critical the affected system is within your infrastructure.
In practice, the Environmental Score is rarely fully completed. Most tools only report the Base Score, which is immediately one of the biggest sources of misinterpretation in vulnerability management.
How the CVSS score ignores the context of your environment
The Base Score describes a vulnerability as if it exists in a vacuum, detached from any specific environment. That is useful for comparison, but dangerous if you use the score directly as a prioritization basis for your organization.
Consider this: a vulnerability has a CVSS score of 9.8 because it is remotely exploitable without authentication. But if the affected system sits behind a firewall that fully blocks external access, the chance that an attacker actually reaches this system is minimal. The score does not change, but your risk does.
The reverse also applies. A vulnerability with a score of 4.0, which looks “medium” on paper, can be catastrophic in your environment if the affected system has access to sensitive customer data or drives critical business processes. The CVSS score does not account for this, unless you carefully complete the Environmental Score — something that rarely happens structurally in day-to-day practice.
During a thorough pentest, an ethical hacker does not only look at individual scores, but specifically at how a vulnerability fits within the broader context of your systems and processes.
Exploitability and threat context as missing puzzle pieces
Two factors that the CVSS score structurally underrepresents are real-world exploitability and threat context. Together, they largely determine how urgent a vulnerability truly is.
Real-world exploitability
Not every vulnerability with a high CVSS score is also actively being attacked. Some vulnerabilities are technically complex to exploit and require specific access or circumstances that rarely occur. Others already have ready-made exploit tools available that even inexperienced attackers can deploy. This difference is enormously relevant for prioritization, but the Base Score does not make this distinction.
Threat context
Threat context is about the question: who wants to attack you, and for what purpose? A vulnerability in industrial control systems is particularly relevant if you are an energy company, but barely relevant if you run an online store. Threat actors target specific sectors, technologies, and organization types. A risk assessment that does not account for who would want to attack you and why is missing a crucial piece of the picture.
Building on what we established earlier: the CVSS score describes the vulnerability, but not the attacker. Attackers do not think in scores. They think in attack paths: which combination of weaknesses will get them to their goal? That is a fundamentally different perspective from a list sorted by CVSS score.
How do you prioritize vulnerabilities based on actual risk?
Effective risk assessment requires more than a single number. A workable prioritization framework combines the CVSS score with additional factors that determine the actual impact in your environment.
Consider the following questions for each vulnerability:
- Is the system reachable by an attacker? A vulnerability on an internal system without external access is harder to exploit than a vulnerability on a publicly accessible web server.
- How critical is the affected system? Systems that process customer data, handle payments, or drive critical processes deserve higher priority than test environments.
- Is there an active exploit available? If public exploit code exists, the barrier for attackers is much lower. This significantly increases urgency.
- Is the vulnerability part of an attack path? A vulnerability with a low score can become dangerous if, combined with other weaknesses, it leads to full access to critical systems.
- Is there a patch or workaround available? If a fix exists, the priority to apply it quickly is higher than when you depend on a vendor.
This kind of context-driven analysis aligns with what is known in the security world as risk-based vulnerability management: not patching in order of CVSS score, but based on actual risk to your organization.
Common mistakes when interpreting CVSS scores
Even experienced security teams regularly make the same mistakes when working with CVSS scores. By knowing them, you can avoid them.
Mistake 1: Treating the Base Score as the definitive risk
The most common mistake is using the Base Score as the sole measure for prioritization. As discussed earlier, the Base Score completely ignores your specific environment. A score of 9.8 on a system that no one can reach is less urgent than a score of 5.0 on a publicly accessible system with sensitive data.
Mistake 2: Only looking at individual vulnerabilities
Attackers do not see isolated findings. They see attack paths. An incorrect Azure configuration, overly broad permissions, and an unsecured application setting may each be scored low on their own. But combined, they can lead to full access to cloud resources. Those who only look at individual CVSS scores completely miss this combined threat.
Mistake 3: Wanting to patch everything at once
Organizations that want to immediately fix every vulnerability with a high CVSS score quickly become overwhelmed. Without prioritization based on actual risk, security teams get consumed by urgency that exists on paper but is limited in practice. The result is that the truly dangerous vulnerabilities are sometimes addressed too late.
Mistake 4: Ignoring the Temporal and Environmental Score
Many tools display only the Base Score by default. The Temporal Score and Environmental Score exist precisely to refine the score to your situation. Completing the Environmental Score takes time, but delivers a considerably more realistic picture of your actual risk.
From CVSS score to a continuous risk picture
Building on everything covered above: a CVSS score is a starting point, not an endpoint. Those who base their vulnerability management on an annual scan and a sorted list of scores have insight at that one moment, but do not know what changes afterward.
IT environments are constantly in motion. Applications are updated, accounts added, permissions changed, and new cloud resources created. Every change can introduce new vulnerabilities or place existing vulnerabilities in a different light. A vulnerability that had low priority last month can suddenly become part of a dangerous attack path due to a configuration change.
Effective vulnerability management therefore requires a continuous risk picture: regular revision of priorities, combined with insight into how your environment changes and which new threats become relevant. That is fundamentally different from an annual snapshot.
Moreover, a continuous risk picture requires the ability to recognize attack paths, not just individual vulnerabilities. That demands the mindset of an attacker: who wants to target me, how would they go about it, and which combination of weaknesses would they exploit? Automated scanners do not answer that question. Human reasoning does.
How Q-Cyber helps with risk assessment beyond the CVSS score
At Q-Cyber, we believe that a CVSS score only gains meaning when it is placed in the context of your organization, your environment, and the threats that are relevant to you. We help organizations move from a list of vulnerabilities to a realistic and actionable risk picture.
Concretely, we do this through:
- Manual pentests in which our ethical hackers not only identify individual vulnerabilities, but also investigate how those vulnerabilities can be combined into attack paths that are truly dangerous.
- Attack path analysis that makes clear which combinations of weaknesses, misconfigurations, and permissions pave the way for an attacker to critical systems, even when individual findings score low.
- Context-driven prioritization so your security team knows which vulnerabilities are truly urgent in your specific environment, instead of working based on a generic score.
- Continuous insight through our Continuous-Q® program, so you are not dependent on an annual snapshot but maintain an up-to-date risk picture that moves with your environment.
Want to know how your organization truly stands, beyond the CVSS scores? Get in touch with us and we will look together at what your situation requires.