What it means
CVSS provides a structured way to describe vulnerability characteristics and calculate technical severity. Scores should travel with their version and vector, which records the metric choices behind the number. Version 4.0 includes Base, Threat, Environmental, and Supplemental metric groups; not every published score uses every group. CVSS is useful for comparing technical characteristics, but a high score alone does not establish local business risk or the order of every repair. You still need asset context, actual exposure, exploitation information, and operational constraints.
AN ILLUSTRATIVE SCENARIO
Two critical findings compete for one maintenance window
A manufacturer has a severe flaw in an internet-facing remote-access appliance and another in a development system on a restricted network. Both findings deserve attention. The team examines their CVSS vectors, then considers current reachability, known exploitation, the assets each can affect, and available mitigations. The appliance may take priority even if its numerical score is slightly lower. The decision records those reasons rather than inventing meaning in tiny score differences.
Put it to work
- Record the CVSS version, score type, source, and full vector. Read the affected-product advisory so you understand the assumptions behind the published severity.
- Check environmental conditions relevant to your deployment and document any justified adjustments using the appropriate version’s method. Keep original and adjusted assessments distinguishable.
- Combine severity with separate evidence about exploitation, exposure, business impact, and remediation effort. Assign an owner and deadline based on the complete decision.
How to check your work
Use FIRST’s specification or calculator to reproduce one score from its vector. Then ask whether the remediation decision would change with different exposure or asset importance, even though the published technical severity remains the same.
Connect the ideas
- CVE
A public identifier for a specific disclosed vulnerability record.
- EPSS
FIRST’s estimate of the probability that a vulnerability will be exploited in the wild over the next 30 days.
- Exposure
Whether and how a vulnerability or service can actually be reached in this environment.
- Risk
The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.