(Common Vulnerability Scoring System) defines a qualitative scale so a numeric score can be spoken about in words. The bands are fixed:
- None: 0.0
- Low: 0.1 to 3.9
- Medium: 4.0 to 6.9
- High: 7.0 to 8.9
- Critical: 9.0 to 10.0
These boundaries are part of the specification, so a score of 6.9 is Medium and 7.0 is High even though they are almost the same number. That sharp edge is worth remembering when a score sits near a boundary.
Severity is not risk
The most important thing to understand about a CVSS Base score is what it deliberately leaves out. The base measures the intrinsic severity of a flaw under a reasonable worst-case assumption. It does not measure your risk. In particular, the Base score knows nothing about:
- Exploitation in the wild. Whether an exploit exists or is being used actively is a Temporal or threat-intelligence question. A separate FIRST.org (Forum of Incident Response and Security Teams) effort, (Exploit Prediction Scoring System), estimates the probability of exploitation and is a better input for that dimension.
- Asset value. A Critical flaw on a disposable test box and on a payment system share the same base number. Only Environmental scoring, or your own asset context, distinguishes them.
- Compensating controls. A network-only mitigation, a rule, or the fact that a service is unreachable from the internet does not change the base at all.
Using the bands well
The bands are good for coarse triage and for communication, and Critical genuinely deserves attention. But ranking a backlog purely by descending Base score will send you to reachable-but-harmless flaws before quiet, high-value ones. A more defensible order combines the Base severity with exploitation likelihood (for example EPSS or known-exploited catalogues) and with your own asset value and controls, which is exactly what Temporal and Environmental scoring exist to capture. The Base number is where prioritisation starts, not where it ends.
What the bands do to a patching policy
A rule like "all Criticals within seven days" turns a severity scale into a deadline, and the scale was never built to carry one. Two consequences follow, and both are visible in any large estate.
A 9.0 on a system nobody can reach from anywhere is not more urgent than a 7.5 on your public front door — but the policy says it is, so the work goes to the wrong place first.
And the sharp edge becomes a lever. When 6.9 means "next quarter" and 7.0 means "this week", the argument stops being about the flaw and starts being about the metrics that produce the number.
The practical correction is not a better scale. It is a second input: whether the thing is actually being exploited. CISA's Known Exploited Vulnerabilities catalogue exists precisely because is somebody using this today answers a different question from how bad would it be.