CVSS Vulnerability Scoring: A Practical Guide for Developers
CVSS (Common Vulnerability Scoring System) is the standard scoring system used to rate the severity of software vulnerabilities. Scores range from 0 to 10: Critical (9.0–10.0), High (7.0–8.9), Medium (4.0–6.9), Low (0.1–3.9). CVSS Base scores measure inherent severity; Temporal scores adjust for exploit maturity; Environmental scores adjust for your specific deployment context. Understanding CVSS helps you prioritize which vulnerabilities to fix first—a Critical score in a library you use for non-critical functionality may be lower actual risk than a Medium in your authentication system.
Key Takeaways
CVSS Base Score measures inherent risk, not actual risk to you. Base score assumes worst-case deployment. A Critical CVE in a web framework assumes that framework is internet-facing, fully exposed, with no mitigating controls. Adjust with Environmental scores.
Attack Vector is the most important Base metric. Network-accessible vulnerabilities (AV:N) are critical. Local-only vulnerabilities (AV:L) require local access first—much lower risk for cloud services.
Privileges Required and User Interaction dramatically affect risk. CVE requiring admin privileges (PR:H) is far less dangerous than one requiring no privileges (PR:N). CVE requiring user interaction (UI:R) is far less dangerous than one triggered automatically.
Temporal scores account for exploit availability. A Critical CVE with no public exploit and an official patch available (RC:C, RL:O) is lower actual risk than a High CVE with a weaponized exploit in the wild (E:A, RL:U).
Environmental scores let you reflect your actual deployment. If a network vulnerability is blocked by your firewall (scope reduced to internal only), your Environmental score drops significantly. Use this to deprioritize CVEs that don't apply to your deployment.
CVSS Score Ranges
| Score | Severity | Remediation Guidance |
|---|---|---|
| 9.0–10.0 | Critical | Patch within 24 hours. Block traffic if patch unavailable. |
| 7.0–8.9 | High | Patch within the current sprint (1–2 weeks). |
| 4.0–6.9 | Medium | Schedule for next sprint. No immediate action required unless exploit is public. |
| 0.1–3.9 | Low | Address in quarterly security cleanup. |
| 0.0 | None | No security impact. |
CVSS v3.1 Base Score Metrics
The Base score is calculated from two groups of metrics:
Exploitability Metrics
| Metric | Values | Description |
|---|---|---|
| Attack Vector (AV) | Network (N), Adjacent (A), Local (L), Physical (P) | How is the vulnerability reached? |
| Attack Complexity (AC) | Low (L), High (H) | How hard is exploitation? |
| Privileges Required (PR) | None (N), Low (L), High (H) | What access level does the attacker need? |
| User Interaction (UI) | None (N), Required (R) | Does exploitation require a user action? |
Impact Metrics
| Metric | Values | Description |
|---|---|---|
| Scope (S) | Unchanged (U), Changed (C) | Does exploitation affect other components? |
| Confidentiality (C) | None (N), Low (L), High (H) | Impact on data confidentiality |
| Integrity (I) | None (N), Low (L), High (H) | Impact on data integrity |
| Availability (A) | None (N), Low (L), High (H) | Impact on availability |
Reading CVSS Vectors
CVSS scores come with a vector string that encodes all metrics:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HBreaking this down:
AV:N— Attack Vector: Network (internet-accessible)AC:L— Attack Complexity: Low (no special conditions)PR:N— Privileges Required: None (no login needed)UI:N— User Interaction: None (no victim action required)S:U— Scope: Unchanged (only the vulnerable component is affected)C:H— Confidentiality: High (full data exposure)I:H— Integrity: High (full data modification)A:H— Availability: High (complete service disruption)
This is a 9.8 Critical — a remotely exploitable, unauthenticated RCE with complete impact.
Compare to:
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:NAV:L— Local access requiredAC:H— Complex exploitation conditionsPR:H— Admin privileges requiredUI:R— Victim must take action
This is a 0.9 Low — realistically unexploitable in most deployments.
Temporal Score Adjustments
Temporal metrics adjust the Base score based on current exploit activity:
Exploit Code Maturity (E)
| Value | Meaning | Effect on Score |
|---|---|---|
| Not Defined (X) | No data | No adjustment |
| Unproven (U) | No exploit exists | Score ↓ |
| Proof-of-Concept (P) | PoC exists, not weaponized | Score slightly ↓ |
| Functional (F) | Working exploit available | Minimal adjustment |
| High/Active (H/A) | Exploit in widespread use | Score unchanged (already at Base) |
Remediation Level (RL)
| Value | Meaning |
|---|---|
| Official Fix (O) | Vendor patch available |
| Temporary Fix (T) | Workaround exists |
| Workaround (W) | Informal workaround |
| Unavailable (U) | No remediation exists |
Practical implication: A Critical CVE with RL:O (official fix available) is much lower urgency than one with RL:U (no fix). If a patch exists, update it. If no patch exists, you need compensating controls.
Environmental Score — Adapting for Your Deployment
Environmental metrics let you account for your specific deployment context:
Modified Attack Vector
If a Network-accessible vulnerability is behind your firewall and only accessible internally:
Base: AV:N (score component: 0.85)
Modified: MAV:A or MAV:L (score component: 0.62 or 0.55)This can drop a Critical to High or High to Medium.
Modified Impact (Confidentiality, Integrity, Availability Requirement)
If your application serves public data and data confidentiality is Low priority:
CR:L (Confidentiality Requirement: Low)
IR:H (Integrity Requirement: High — data accuracy matters more)
AR:M (Availability Requirement: Medium)Example Environmental Adjustment
A CVE in your web framework:
- Base Score: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H)
- Your deployment: internal application, behind VPN, no internet access
Environmental adjustment:
MAV:A (Adjacent — only accessible via internal network)
MC:L (Lower confidentiality impact — internal app, data not sensitive)Adjusted Environmental Score: 5.1 Medium
This doesn't mean you shouldn't patch it—it means you have more time and it's not a production emergency.
Prioritization Framework
Not all Critical CVEs are equal. Use this matrix:
| CVSS Score | Exploit in Wild | Patch Available | Priority |
|---|---|---|---|
| Critical (9+) | Yes | Yes | P0: Patch now |
| Critical (9+) | Yes | No | P0: Mitigate now (WAF, firewall, disable feature) |
| Critical (9+) | No | Yes | P1: Patch this week |
| High (7–8.9) | Yes | Yes | P1: Patch this week |
| High (7–8.9) | No | Yes | P2: Patch this sprint |
| Medium (4–6.9) | No | Yes | P3: Patch next sprint |
| Any | No | No | P3/P4: Monitor for fix |
Check the CISA Known Exploited Vulnerabilities (KEV) catalog at cisa.gov/known-exploited-vulnerabilities-catalog. Any CVE on the KEV list has confirmed exploitation in the wild—treat it as P0 regardless of CVSS score.
Using CVSS in Your Security Pipeline
Configuring CVSS Thresholds in SCA Tools
# .grype.yaml — fail on CVSS >= 7.0
fail-on-severity: high
# Trivy
trivy fs . --severity CRITICAL,HIGH --exit-code 1
# Snyk
snyk test --severity-threshold=highCVSS in DAST Reports
DAST tools like OWASP ZAP and Burp Suite report findings with CVSS scores. When reviewing:
- Sort by CVSS score (highest first)
- Check if each high/critical finding has a public exploit (
E:HorE:A) - Check CISA KEV catalog for the CVE identifier
- Adjust for your deployment (internal vs internet-facing)
- Create remediation tickets with priority based on adjusted score
CVSS in Penetration Test Reports
Pentest reports use CVSS to score findings. When reviewing:
- Ask the pentester for the Environmental adjusted score, not just the Base score
- A Critical Base score for an internal-only service is not an emergency
- A Medium Base score for an externally exploited service is
CVSS v4.0
CVSS v4.0 was released in 2023, adding:
- More granular metrics (Attack Requirements, subsequent system impact)
- Better handling of OT/ICS (operational technology)
- Clearer vocabulary for safety impact
Most tools still report v3.1. When you see CVSS:4.0 vectors:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NNew in v4.0:
AT— Attack Requirements (None/Present)VC/VI/VA— Vulnerable component C/I/ASC/SI/SA— Subsequent component C/I/A
Summary
CVSS is a tool for communication and prioritization, not a strict rule. The right way to use CVSS scores in your security workflow:
- Base score from the CVE database = starting point
- Check CISA KEV catalog = escalate anything on it to P0
- Check Temporal metrics (E, RL) = active exploits and patch availability
- Apply Environmental adjustments = adjust for your deployment context
- Prioritize: P0 now, P1 this week, P2 this sprint, P3 next sprint
Never ignore Critical CVEs—but also don't panic about every Critical score before checking whether it actually applies to your deployment.
