What is CVSS?
The CVSS (Common Vulnerability Scoring System) rates the severity of a vulnerability on a scale of 0 to 10. Maintained by FIRST, it produces a score, a severity rating and a reproducible “vector”. It measures potential damage — not the likelihood that it happens.
An advisory says “CVSS 9.8”. Management asks whether that's worse than last week's 8.1. The honest answer fits on one page, and it starts with reading the vector rather than the number.
Two images to make it concrete
CVSS is the magnitude of an earthquake. A magnitude 8 earthquake releases enormous energy, whether it strikes a megacity or an uninhabited desert. Magnitude describes the event, never its consequences for you. That is exactly the relationship between a CVSS score and your information system.
CVSS is also the spec sheet of a car. It lists a top speed of 250 km/h. It says nothing about how fast you are driving, whether the road is wet, or whether someone else has the keys. Two images are better than one here: the first shows that the score is intrinsic, the second that it describes a potential that context may never realize.
The five severity levels
The score maps to a qualitative label, the one that appears in advisories:
| CVSS score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
These thresholds apply to CVSS 3.x and 4.0. The older CVSS 2.0 had only three levels and no “critical” label at all: the same flaw can therefore carry two different labels depending on the version used to score it.
Reading a vector field by field
The score doesn't come out of nowhere: it is calculated from a vector, a string that encodes eight decisions. Take the one for Log4Shell (CVE-2021-44228):
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
It reads left to right, like a sentence:
| Field | Value | What it means |
|---|---|---|
AV — attack vector | N (network) | Exploitable from the internet, with no prior access to the local network. |
AC — attack complexity | L (low) | No special conditions: the attack works every time. |
PR — privileges required | N (none) | No account needed. |
UI — user interaction | N (none) | Nobody has to click anything. |
S — scope | C (changed) | The damage spills beyond the vulnerable component and reaches what sits behind it. |
C / I / A | H / H / H | Total impact on confidentiality, integrity and availability. |
Resulting score: 10.0. Now the part almost nobody shows — what changing a single field does:
| Change | New score | What it means |
|---|---|---|
S:C → S:U (damage stays contained) | 9.8 | This is the famous “9.8” you see everywhere: unauthenticated remote code execution, with no scope change. |
PR:N → PR:H (an administrator account is required) | 9.1 | Requiring a privileged account shrinks the attack surface, yet costs only about one point: CVSS stays harsh when impacts are total. |
AV:N → AV:L (local access required) | 9.3 | Having to be on the machine already changes everything in practice… and almost nothing in the score. |
Check it yourself: each of these vectors can be recalculated in the CVSS 3.1 calculator. It's the ten-minute exercise that takes you from “I read a number” to “I understand a rating”.
Base, threat, environmental: three layers
CVSS has three metric groups, and the vast majority of public databases publish only one.
- Base: intrinsic severity, stable over time. It's the score you see 99% of the time.
- Temporal / threat: adjusts for exploit maturity and whether a fix exists. It can only lower the base score.
- Environmental: tailors the score to your context — asset criticality, compensating controls, your specific confidentiality or availability requirements.
The direct consequence: the score you read in an advisory was never calculated for you. The environmental layer, the one that concerns you, is yours to fill in — and almost nobody does.
Versions: 2.0, 3.0, 3.1 and 4.0
| Version | What it changes | Where you see it |
|---|---|---|
| 2.0 (2007) | Coarser metrics, no “critical” level, impacts graded as partial/complete. | Archives and old scanner reports. |
| 3.0 (2015) | Introduces the scope metric (Scope) and privileges required. | CVEs published between 2016 and 2019. |
| 3.1 (2019) | Clarifies rounding and documentation; formulas identical to 3.0. | The vast majority of NVD CVEs today. |
| 4.0 (2023) | Removes Scope and replaces it with two impact blocks: VC/VI/VA for the vulnerable system, SC/SI/SA for the systems behind it. Adds attack requirements (AT). | A growing number of vendor advisories. |
What the 4.0 change means in practice: a hypervisor flaw that compromises guest virtual machines is finally scored for what it is, instead of being squeezed into a single “scope changed” flag. All four versions can be compared in the calculator.
Heartbleed 7.5, Log4Shell 10.0: what the gap tells you
CVE-2014-0160 (Heartbleed) is rated 7.5 in CVSS 3.1 — “high”, not “critical”. Its vector assigns impact to confidentiality only: the flaw lets an attacker read the server's memory, without modifying or disrupting anything. On paper, that's less serious than code execution.
In reality, it exposed TLS private keys across a massive share of the web and triggered a worldwide certificate replacement campaign. CVE-2021-44228 (Log4Shell), rated 10.0, made even more noise — but the 2.5-point gap between the two does not measure the gap in real-world impact. CVSS rates a mechanism, not a consequence.
The most time-consuming mistake
What it means for you, in practice
A working rule that fits in four lines, ready to apply on Monday:
- Never sort by CVSS alone. Use it to break ties, not to set the order.
- For the flaws that affect you, read the vector before the score:
AV:LorPR:Hon a machine with no external access often means one less emergency. - Fill in the environmental layer for your ten most critical assets — not for the thousand others. That's where the effort pays off.
- Record the version next to every score. A 7.0 in 2.0 and a 7.0 in 4.0 do not describe the same thing.