{"id":3521,"date":"2026-10-18T08:00:00","date_gmt":"2026-10-18T06:00:00","guid":{"rendered":"https:\/\/q-cyber.nl\/?p=3521"},"modified":"2026-10-02T13:27:14","modified_gmt":"2026-10-02T11:27:14","slug":"what-is-cvss-and-how-is-vulnerability-severity-determined","status":"publish","type":"post","link":"https:\/\/q-cyber.nl\/en\/blog\/what-is-cvss-and-how-is-vulnerability-severity-determined\/","title":{"rendered":"What Is CVSS and How Is the Severity of a Vulnerability Determined?"},"content":{"rendered":"

When a new vulnerability in software is discovered, the immediate question arises: how serious is this, really? Is it a problem that needs to be resolved today, or can it wait until the next maintenance cycle? To answer that question in a structured and consistent way, the Common Vulnerability Scoring System<\/strong> exists, better known as CVSS. In this article you will learn what CVSS is, how the score is calculated, what the severity categories mean, and how to apply CVSS wisely within your own security practice.<\/p>\n

We build the knowledge step by step: from the origin of the system, through the technical workings, to the practical application. By the end, you will understand not only what a CVSS score says, but also what it does not<\/em> say, and why that distinction is crucial for good cybersecurity.<\/p>\n

What is CVSS and where does it come from?<\/h2>\n

The Common Vulnerability Scoring System<\/strong> is an open standard for assessing the severity of vulnerabilities in software and systems. The system provides a standardized way to compare vulnerabilities, regardless of the type of system or vendor where they were found.<\/p>\n

CVSS was developed by the Forum of Incident Response and Security Teams (FIRST)<\/strong> and was first published in 2005. Since then, the system has been revised several times. The most widely used version is CVSS 3.1, but CVSS 4.0 is now available and introduces further refinements for more modern IT environments. The scores are published through the National Vulnerability Database (NVD)<\/strong> of the US government, which maintains a CVSS score for virtually every known vulnerability.<\/p>\n

The goal of CVSS is simple: to provide a common language so that security teams, vendors, and organizations around the world can discuss the severity of a vulnerability in the same way. Without such a standard, every party would use its own measuring stick, making comparison and prioritization virtually impossible.<\/p>\n

How does the CVSS score work and what do the base metrics measure?<\/h2>\n

A CVSS score<\/strong> is a number between 0.0 and 10.0, where a higher score indicates a more severe vulnerability. That score is calculated based on a set of metrics<\/strong>, divided into three groups: the base metrics, the temporal metrics, and the environmental metrics. The base metrics form the foundation and are applied most consistently.<\/p>\n

The base metrics: what is being measured?<\/h3>\n

The base metrics describe the intrinsic characteristics of a vulnerability, independent of the specific context of an organization. They are divided into two categories:<\/p>\n