How CVSS Scoring Works: Understanding Vulnerability Severity

When a new vulnerability is announced, the first question most IT teams ask is: how bad is it? The answer comes from CVSS — a scoring system that turns a complex set of technical factors into a single number between 0 and 10. The higher the number, the worse the vulnerability.

But CVSS is more than just a number. Understanding how it is calculated helps you make smarter patching decisions and explain risk to non-technical stakeholders in language they understand.

What is CVSS?

CVSS stands for Common Vulnerability Scoring System. It is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS is maintained by FIRST (Forum of Incident Response and Security Teams) and is currently on version 3.1, with version 4.0 published in 2023.

In simple terms: CVSS is like a medical triage scale. A score of 10 means "rush to the operating theatre now." A score of 2 means "schedule a routine appointment."

The National Vulnerability Database (NVD) at NIST publishes CVSS scores for every CVE. When you look up a CVE, the CVSS score is one of the first things you see.

The 0–10 score scale

Base score metrics

The CVSS Base Score measures the intrinsic characteristics of a vulnerability — things that do not change over time or environment. It is calculated from two groups of metrics:

Exploitability metrics (how easy is it to attack?)

• Attack Vector (AV) — where does the attacker need to be? Network (worst), Adjacent, Local, or Physical (least severe).
• Attack Complexity (AC) — how hard is the attack? Low (just fire the exploit) or High (requires specific conditions).
• Privileges Required (PR) — does the attacker need an account? None, Low (regular user), or High (admin).
• User Interaction (UI) — does a victim need to click something? None or Required.

Impact metrics (how bad is the damage?)

CVSS measures impact across three dimensions — the classic security triad:

• Confidentiality (C) — can the attacker read data they should not? None, Low, or High.
• Integrity (I) — can the attacker modify data? None, Low, or High.
• Availability (A) — can the attacker take the service down? None, Low, or High.

A vulnerability that scores High on all three impact dimensions, requires no privileges, no user interaction, and can be exploited over the network with low complexity — that is a 10.0. That is Log4Shell (CVE-2021-44228).

Temporal and environmental scores

Beyond the Base Score, CVSS has two optional modifier layers:

Temporal Score

The Temporal Score adjusts the base score based on factors that change over time:

• Exploit Code Maturity — is there a working exploit publicly available? If attackers have a ready-made tool, severity increases.
• Remediation Level — is there an official patch? A workaround reduces urgency slightly; no fix at all increases it.
• Report Confidence — how certain is the information? Confirmed by the vendor scores higher than an unconfirmed rumour.

Environmental Score

The Environmental Score lets your organisation adjust the base score based on your specific situation:

• If the vulnerable software is not deployed in your environment, the effective score is 0.
• If the vulnerable component handles your most sensitive customer data, you can weight the Confidentiality impact higher.

Most teams work with the Base Score because it is standardised. The Environmental Score is most useful for mature security operations with asset inventory tools.

Real scoring examples

Let us look at three real CVEs to see how the score reflects real-world severity:

CVE-2021-44228 — Log4Shell CRITICAL 10.0

Attack Vector: Network. Complexity: Low. No privileges needed. No user interaction. Full confidentiality, integrity, and availability impact. A remote attacker could execute arbitrary code on millions of servers with a single request. Score: 10.0.

CVE-2023-34048 — VMware vCenter RCE CRITICAL 9.8

A heap overflow in vCenter allowed unauthenticated remote code execution. Network attack vector, low complexity, no privileges. Score: 9.8. Actively exploited by nation-state actors within weeks of disclosure.

CVE-2023-20198 — Cisco IOS XE CRITICAL 10.0

A privilege escalation in Cisco's web UI allowed attackers to create admin accounts with no authentication. Used to compromise tens of thousands of network devices within days. Score: 10.0.

How to use CVSS in practice

Here is a simple prioritisation workflow for any IT team:

1. Get CVE feeds — subscribe to NVD, vendor security bulletins, or use a vulnerability scanner (Tenable Nessus, Qualys, OpenVAS).
2. Filter by severity — start with Critical (9.0+), then High (7.0+). Do not lose sleep over Low scores until the urgent work is done.
3. Check CISA KEV — any CVE in the Known Exploited Vulnerabilities catalog is being exploited right now. These jump the queue regardless of CVSS score.
4. Confirm you are affected — check your asset inventory. If the vulnerable product is not in your environment, move on.
5. Patch or mitigate — apply the vendor patch. If no patch exists, apply the vendor's workaround and set a reminder to patch when one arrives.
6. Document and close — record what you patched and when. Auditors love this.

Limitations of CVSS

CVSS is useful but imperfect. Know its limits:

• It ignores threat intelligence — a 9.8 score CVE with no public exploit and no known attacks may be less urgent than a 7.5 score CVE being actively exploited by ransomware gangs. CVSS alone does not tell you this — the CISA KEV catalog does.
• It does not consider asset value — a medium-severity CVE in your payment processing server is more urgent than a critical CVE in a test machine with no internet access.
• Scores change — NVD sometimes recalculates scores after initial publication. Always check the current score, not one from an old report.

Frequently asked questions

What is a good CVSS score?

Lower is better. A score of 0 means no severity. Anything below 4.0 is low risk. Scores of 9.0 and above are Critical and require immediate action.

Who calculates the CVSS score?

The NVD team at NIST calculates Base Scores for all published CVEs. Vendors also publish their own scores for vulnerabilities in their products, sometimes differing slightly from NVD's assessment.

Is CVSS v3.1 or v4.0 better?

CVSS v4.0 (released November 2023) adds new metrics including supplemental scores and better support for operational technology (OT/ICS) systems. Most public databases still primarily show v3.1 scores. Both use the same 0–10 scale, so the severity bands are comparable.

Can a CVSS 10.0 vulnerability not affect me?

Yes. If you do not run the vulnerable software, a CVSS 10.0 score is irrelevant to you. Always confirm affected versions against your actual asset inventory before escalating.