What it means
CVSS provides a structured way to describe vulnerability characteristics and calculate technical severity. Scores should travel with their version and vector, which records the metric choices behind the number. Version 4.0 includes Base, Threat, Environmental, and Supplemental metric groups; not every published score uses every group. CVSS is useful for comparing technical characteristics, but a high score alone does not establish local business risk or the order of every repair. You still need asset context, actual exposure, exploitation information, and operational constraints.
The idea at a glance / Vulnerabilities
Keep severity fixed while comparing local priorities.
The same published Base score can inform different local response plans. Keep the version, metric choices, and source attached to the number.
Apache publishes a CVSS 3.1 Base score of 10.0 for CVE-2021-44228. Synthetic G71 and L71 each contain log4j-core 2.14.1. G71 is an important public service; L71 is an isolated test service. Maya’s illustrative owner calls differ. Both response plans remain open.
READ THE PICTURE
Read the evidence and its limits
Apache’s unchanged CVSS 3.1 Base vector scores 10.0, Critical. The same severity accompanies both synthetic assets. Maya plans to act on the important public service today and schedule the isolated test service for its next change window. These recorded plans are separate from the score and remain unfinished.
Keep in mindThe local context and owner calls are teaching assumptions, not a universal priority rule. The Base vector is unchanged; no Environmental adjustment or CVSS 4.0 score is calculated here. Neither a Critical label nor an owner plan establishes a local compromise or completed repair.
Read the complete example
- Read the evidence and its limits. Apache’s unchanged CVSS 3.1 Base vector scores 10.0, Critical. The same severity accompanies both synthetic assets. Maya plans to act on the important public service today and schedule the isolated test service for its next change window. These recorded plans are separate from the score and remain unfinished. For CVE-2021-44228, the complete vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. It specifies a network attack, low attack complexity, no privileges or user interaction required, changed security scope, and high confidentiality, integrity, and availability impacts. FIRST’s 3.1 Base calculation gives 10.0 for those choices; the illustration reproduces Apache’s assessment rather than silently converting it to another version. CVSS is owned by FIRST and used by permission. The assumed local records dated 2026-09-30 describe G71 as an important exposed production service and L71 as an isolated test service with synthetic data. Maya records distinct next actions, not calculated risk percentages or a claim that restriction removes the defect. Both retain the original Base severity and require applicable vendor action, operational checks, and verification. A justified Environmental assessment must be recorded separately under the chosen version. CVSS 4.0 has different metrics and scoring; its Base, Threat, Environmental, and Supplemental groups are not this 3.1 vector.
The local context and owner calls are teaching assumptions, not a universal priority rule. The Base vector is unchanged; no Environmental adjustment or CVSS 4.0 score is calculated here. Neither a Critical label nor an owner plan establishes a local compromise or completed repair.
Diagram references: FIRST: CVSS 3.1 specification · FIRST: CVSS 4.0 specification · Apache: Log4j security advisories
AN ILLUSTRATIVE SCENARIO
One Critical score, two recorded plans
Apache’s published CVSS 3.1 Base vector for CVE-2021-44228 scores 10.0. In a fictional review, Vera records action today for important public service G71 and the next change window for isolated test service L71. Both contain the same selected affected component version. The original vector and severity remain unchanged. These illustrative calls use separate asset context; they are not an automatic scoring policy. Neither plan records a completed repair, and the team can revise either call when applicability, exploitation evidence, or operational constraints change.
Put it to work
- Record the CVSS version, score type, source, and full vector. Read the affected-product advisory so you understand the assumptions behind the published severity.
- Check environmental conditions relevant to your deployment and document any justified adjustments using the appropriate version’s method. Keep original and adjusted assessments distinguishable.
- Combine severity with separate evidence about exploitation, exposure, business impact, and remediation effort. Assign an owner and deadline based on the complete decision.
How to check your work
Use FIRST’s specification or calculator to reproduce one score from its vector. Then ask whether the remediation decision would change with different exposure or asset importance, even though the published technical severity remains the same.
Connect the ideas
- CVE
A public identifier for a specific disclosed vulnerability record.
- EPSS
FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.
- Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.