What is CVSS?

CVSS scores are built from metric groups, and understanding the Base metrics is what lets an analyst read past the single number to what actually makes a vulnerability dangerous. Attack Vector describes how the attacker reaches the flaw, network, adjacent network, local, or physical, with network-reachable vulnerabilities scoring higher since they need no local access at all. Attack Complexity captures whether exploitation requires specific conditions to align (low complexity means a reliable, repeatable exploit; high means the attacker needs favorable timing or configuration). Privileges Required and User Interaction describe whether the attacker needs an existing account or needs a victim to click something, and Scope captures whether a successful exploit can affect resources beyond the vulnerable component itself, for example a container escape reaching the host. The Impact metrics then score confidentiality, integrity, and availability separately, since a flaw that only lets an attacker crash a service (availability) is fundamentally different from one that lets them read arbitrary files (confidentiality) or modify data undetected (integrity).

Version 3.1, still the most widely deployed, defines severity bands from these Base scores: 0.1 to 3.9 is Low, 4.0 to 6.9 is Medium, 7.0 to 8.9 is High, and 9.0 to 10.0 is Critical. CVSS 4.0, released to address known gaps in 3.1, splits the framework further into Base, Threat (does an exploit actually exist in the wild), Environmental (does this organization's specific configuration change the impact), and Supplemental metrics, explicitly separating theoretical severity from real-world exploitability and organizational context, since a 9.8 Critical CVSS score on a system that's air-gapped and never internet-facing carries very different real risk than the same score on an internet-facing production server.

The practical failure mode security teams run into is patching purely by CVSS number without adjusting for actual exposure and exploitability, which is exactly what the Environmental and Threat metric groups, and separately CISA's Known Exploited Vulnerabilities catalog, exist to correct. A Medium-scored CVE with active in-the-wild exploitation against your specific software version deserves faster remediation than a Critical-scored one with no known exploit code and mitigating network controls already in place.