Wrong claim
Why it feels true
Sorting a vulnerability scanner spreadsheet from 10.0 down to 0.0 feels objective and effortless.
Precise correction
The FIRST CVSS v4.0 User Guide says CVSS Base (CVSS-B) scores measure severity and should not be used alone to assess risk.
At Meridian Space & Robotics (chronos.), Threat Hunter Nyx and Propulsion Lead Priya Nair add reachability, asset impact, and exploitation signals to severity. The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence of exploitation in the wild, and FIRST EPSS gives a 30-day exploitation probability.
An internet-facing telemetry gateway with an actively exploited 8.1 finding should come before a 9.8 parser bug in an offline test container.
FIRST CVSS v4.0 User Guide: CVSS-B measures severity, not risk ↗
MINI-CHECK
Two findings in Meridian's backlog carry similar high CVSS Base scores. One is an integration plugin in Meridian's internet-reachable mission portal that can read orbital command keys and is flagged as actively exploited (FINDING-SYNTH-2026-0107 , synthetic teaching ID). The other is a local formatting CLI tool used by two engineers on an air-gapped lab subnet. An engineer proposes patching the lab CLI first because the pull request is smaller. What should Priya Nair record?
Questions
Does a CVSS Base score measure risk?
No. The FIRST CVSS v4.0 User Guide says CVSS Base (CVSS-B) scores measure severity and should not be used alone to assess risk. Patch order also weighs reachability, asset impact, exploitation evidence from CISA KEV, and a 30-day exploitation probability from FIRST EPSS. When a vulnerability is in KEV, FIRST says KEV should take precedence over EPSS.