CVSS

securitygovernance & risk

Stands for: Common Vulnerability Scoring System

A standard 0 to 10 score that rates the severity of a vulnerability.

The Common Vulnerability Scoring System combines factors, how it is exploited, what it impacts, into a number and a vector string, so teams can compare and prioritize. It measures inherent severity, not your specific risk, which also depends on exposure and context.

CVSS exists so that two organizations reading the same vulnerability disclosure arrive at comparable severity numbers rather than arguing from instinct. The vector string encodes how an attack is delivered, how complex it is, what privileges and interaction it needs, and what it costs in confidentiality, integrity, and availability. The score falls out of that arithmetic.

The most common misuse is treating the base score as a priority. Base score describes the vulnerability in the abstract, deliberately ignoring your environment: whether the affected service is exposed to the internet, whether compensating controls exist, whether the asset matters. That is what the temporal and environmental metrics are for, and they are the parts most teams skip.

So a 9.8 on an internal system behind three layers of access control can genuinely deserve less urgency than a 6.5 on a public endpoint handling payment data. Reading the vector rather than the number is what makes that judgment possible, and it is the difference between a patching queue that reflects risk and one that reflects arithmetic.

Also known as: cvss, cvss score, base score

← All glossary entries