CVSS severity ratings

  • None: 0.0
  • Low: 0.1 to 3.9
  • Medium: 4.0 to 6.9
  • High: 7.0 to 8.9
  • Critical: 9.0 to 10.0

How a CVSS score is calculated

The base score reflects the vulnerability itself, using metrics such as the attack vector (network, adjacent, local or physical), attack complexity, privileges required, whether user interaction is needed, and the impact on confidentiality, integrity and availability. Further metric groups can adjust the score for threat context and for a specific organisation's environment. The current version is CVSS v4.0, released in 2023, though many records still carry v3.1 scores.

The limits of CVSS

CVSS measures severity, not risk. A critical score does not mean a vulnerability is being exploited, and a medium score on an internet-facing login system may matter more than a critical one on an isolated test box. Good prioritisation combines CVSS with exploitation evidence, such as the CISA KEV catalogue or EPSS probability scores, and with business context such as asset exposure and data sensitivity.

How DarkInvader helps

DarkInvader shows CVSS scores alongside exploitation status and asset context for each finding, so teams can see which high-severity issues sit on exposed, important systems and deal with those first.

Explore Vulnerability Scanning

Frequently asked questions

Who maintains CVSS?

CVSS is maintained by FIRST, the Forum of Incident Response and Security Teams. The National Vulnerability Database and many vendors publish CVSS scores for CVE records.

What CVSS score counts as critical?

A base score from 9.0 to 10.0 is rated critical. Scores from 7.0 to 8.9 are high.

Should I fix vulnerabilities in CVSS order?

Not strictly. CVSS is a useful starting point, but exploitation status and how exposed the affected asset is usually matter more. An exploited medium on an internet-facing system often deserves attention before an unexploited critical on an internal one.

Related terms and reading

Sources