CVSS (Common Vulnerability Scoring System) is an international standard for measuring the severity of security vulnerabilities in software and systems.
Table of Contents
CVSS uses vendor-neutral criteria and a standardized scoring methodology to express vulnerability severity in a consistent, quantitative way.
By relying on objective metrics rather than vendor-specific interpretations, CVSS enables organizations to compare vulnerabilities across products, environments, and industries using a common language.
What Is the Purpose of CVSS?
The purpose of CVSS is to help organizations consistently assess, compare, and prioritize vulnerabilities based on severity. CVSS scores provide a structured input into vulnerability management and risk-based remediation decisions.
Each vulnerability is assigned a numerical score ranging from 0.0 to 10.0, which is also mapped to qualitative severity levels:
- Low
- Medium
- High
- Critical
Because of its standardized approach, CVSS is widely used by security teams, vendors, incident responders, and vulnerability databases as a primary reference for remediation prioritization.
Who Maintains CVSS and How Has It Evolved?
CVSS is maintained by the CVSS Special Interest Group (CVSS-SIG) under FIRST (Forum of Incident Response and Security Teams). FIRST is an international cybersecurity organization focused on improving incident response and vulnerability coordination worldwide.
Since its introduction, CVSS has undergone multiple revisions to reflect changes in technology and threat landscapes. The most recent major update was announced in July 2023, with CVSS v4.0 officially released in November 2023, marking a significant evolution in how vulnerability severity is evaluated.
FIRST describes CVSS as a framework designed to provide “a standardized approach for assessing the severity of vulnerabilities and helping organizations prioritize response efforts.”
— FIRST (Forum of Incident Response and Security Teams)
What Is CVSS v4.0 and Why Is It Important?
CVSS v4.0 is the latest major version of the CVSS framework, designed to address structural limitations in earlier versions. It improves scoring accuracy, reduces ambiguity, and expands applicability beyond traditional IT environments.
Most notably, CVSS v4.0 introduces clearer metric separation, greater scoring granularity, and explicit support for Operational Technology (OT), Industrial Control Systems (ICS), and IoT environments, reflecting how modern organizations actually operate.
What Metric Groups Make Up CVSS v4.0?
CVSS v4.0 is composed of four metric groups that evaluate vulnerability severity from different perspectives. These groups can be combined to calculate scores aligned to specific use cases.
The four metric groups are:
- Base Metrics – Measure the intrinsic severity of a vulnerability
- Threat Metrics – Reflect real-world exploitation activity
- Environmental Metrics – Customize severity based on organizational context
- Supplemental Metrics – Provide additional response-related context
Each group serves a distinct purpose within vulnerability assessment and response workflows.
What Are CVSS Base Metrics?
Base Metrics measure the inherent severity of a vulnerability, independent of external conditions. They evaluate both how difficult a vulnerability is to exploit and the potential impact if exploitation occurs.
Base Metrics are typically assessed by the product vendor and, once defined, remain stable over time. In CVSS v4.0, Base Metrics have been refined to improve clarity and granularity, enabling more precise severity scoring.
What Are CVSS Threat Metrics?
Threat Metrics evaluate how actively a vulnerability is being exploited in real-world conditions. This metric group focuses on whether exploit code exists and whether exploitation has been observed in the wild.
Because threat activity changes over time, Threat Metrics are inherently dynamic and are generally assessed by vulnerability consumers using threat intelligence and operational context.
Key considerations include:
- Availability of exploit code
- Evidence of active or widespread exploitation
What Are CVSS Environmental Metrics?
Environmental Metrics tailor vulnerability severity to an organization’s specific environment. They account for how critical the affected system is to confidentiality, integrity, and availability within a given organization.
As a result, Environmental Metric scores may differ significantly between organizations depending on system role, business impact, and operational constraints.
What Are CVSS Supplemental Metrics?
Supplemental Metrics provide additional contextual information to support vulnerability response decisions. While they do not influence CVSS score calculations, they offer valuable insight for remediation planning.
Examples of factors captured by Supplemental Metrics include:
- Level of attack automation
- Complexity of recovery
- Effort required to restore affected systems
These metrics help organizations move from severity assessment to practical response planning.
What Types of CVSS Scores Exist in CVSS v4.0?
CVSS v4.0 supports multiple score types based on different combinations of metric groups. This allows organizations to assess vulnerability severity from baseline, environmental, and real-time threat perspectives.
The primary CVSS score types include:
- CVSS-B – Base score only
- CVSS-BE – Base + Environmental
- CVSS-BT – Base + Threat
- CVSS-BTE – Base + Threat + Environmental
For example, organizations assessing vulnerability severity within their own environment typically rely on CVSS-BE, while those incorporating active threat intelligence use CVSS-BTE.
What Changed in CVSS v4.0 Compared to CVSS v3.1?
CVSS v4.0 was developed to address well-documented challenges in CVSS v3.1. Over time, CVSS v3.1 became increasingly misaligned with modern systems and threat conditions.
FIRST identified several key issues, including:
- Overreliance on Base Scores for risk analysis
- Limited influence of Temporal (now Threat) Metrics
- Insufficient representation of real-time threats
- Poor applicability to OT, ICS, and safety-critical systems
- Excessive clustering of scores in “High” and “Critical” ranges
- Limited scoring granularity
- Complex and unintuitive scoring methodology
Challenges of CVSS v3.1 as published by FIRST, summarized and translated for clarity.
How Do These Changes Improve CVSS v4.0?
The updates introduced in CVSS v4.0 make vulnerability scoring more precise, actionable, and relevant. Each change directly targets a limitation identified in previous versions.
Key improvements include:
- Increased granularity within Base Metrics
- Removal of ambiguous downstream scoring logic
- Simplified Threat Metrics with greater scoring influence
- Introduction of Supplemental Metrics for response support
- Expanded applicability to OT, ICS, and IoT environments
FIRST notes that CVSS v4.0 was designed to “better reflect real-world exploitation conditions and modern system architectures.”
Why Is Expanded OT Coverage the Most Significant Change in CVSS v4.0?
The most significant enhancement in CVSS v4.0 is its explicit inclusion of Operational Technology (OT) environments. This is the first CVSS version to formally account for vulnerabilities that may have physical safety implications.
As digital transformation continues to blur the line between IT and OT, vulnerabilities in industrial systems can directly impact production, safety, and human life. CVSS v4.0 reflects this reality by incorporating safety-aware metrics and downstream impact considerations.
How Should Organizations Prepare to Use CVSS v4.0 Effectively?
To use CVSS v4.0 effectively, organizations must adapt vulnerability management practices to account for both IT and OT realities. While CVSS v4.0 improves visibility, response challenges remain—particularly in OT environments.
Key differences include:
- OT systems prioritize availability and safety over patching
- Deployment environments are often closed and vendor-managed
- Patching may be infeasible or explicitly avoided
Without personnel who understand both IT and OT contexts, organizations may struggle to act on vulnerability insights alone.
Why Are OT Asset Visibility and Exploit Prevention Critical?
OT asset visibility and exploit prevention are essential when traditional patching is not practical. Organizations must first understand what OT assets they own before they can manage associated vulnerabilities.
Effective OT vulnerability risk reduction typically involves:
- Comprehensive OT asset discovery
- Continuous network traffic monitoring
- OT-specific sensors and visibility tools
- Virtual patching via OT-focused intrusion prevention systems (IPS)
These controls help prevent exploitation and reduce risk even when vulnerabilities cannot be remediated through patching.
Where Can I Get Help With CVSS and Vulnerability Risk Prioritization?
Trend Vision One™ offers a Cyber Risk Exposure Management (CREM) solution that goes beyond basic CVSS scoring to help organizations understand, prioritize, and reduce risk across their entire attack surface. It combines vulnerability severity scoring with real-time threat intelligence and contextual risk analysis, enabling security teams to make faster, smarter decisions.
This approach integrates key capabilities such as Attack Surface Management, Vulnerability Management, and Security Posture Assessment across IT, OT, cloud, and hybrid environments. It’s not just about identifying vulnerabilities—it’s about turning insights into actionable steps that strengthen resilience and minimize exposure.
With Cyber Risk Exposure Management, you can:
- Gain visibility into your most critical assets and vulnerabilities
- Prioritize remediation based on real-world risk, not just theoretical scores
- Reduce the likelihood of exploitation through proactive risk reduction strategies
Frequently Asked Questions (FAQs)
What does CVSS stand for in cybersecurity?
CVSS stands for Common Vulnerability Scoring System. It is a standardized framework used to measure the severity of security vulnerabilities in software and systems. CVSS provides numerical scores that help organizations compare vulnerabilities consistently and prioritize remediation efforts.
What is a CVSS score?
A CVSS score is a numerical value that represents the severity of a vulnerability. Scores range from 0.0 to 10.0, with higher scores indicating greater risk. These scores are commonly categorized as Low, Medium, High, or Critical.
Who uses CVSS scores?
CVSS scores are used by security teams, vendors, and vulnerability databases worldwide. Organizations rely on them to prioritize patching, guide incident response, and support risk-based vulnerability management decisions across diverse environments.
What is the difference between CVSS v3.1 and CVSS v4.0?
CVSS v4.0 improves accuracy and applicability compared to CVSS v3.1. It introduces greater scoring granularity, simplifies threat evaluation, and expands coverage to OT, ICS, and IoT environments while reducing scoring ambiguity.
What are the metric groups in CVSS v4.0?
CVSS v4.0 includes four metric groups that assess vulnerability severity from different perspectives. These are Base Metrics, Threat Metrics, Environmental Metrics, and Supplemental Metrics, which together support more context-aware severity scoring.