Process and analysis
What is CVSS?
Common Vulnerability Scoring System: a 0 to 10 score of how severe a vulnerability is, based on its technical characteristics.
The Common Vulnerability Scoring System rates the technical severity of a vulnerability from 0 to 10, based on factors such as attack vector, complexity, required privileges, user interaction and impact on confidentiality, integrity and availability. Version 4.0 was released by FIRST in 2023.
CVSS measures severity, not risk. A 9.8 in software you do not run, or that nobody exploits, may matter less than a 6.5 that is being actively exploited on your internet-facing VPN. Teams combine CVSS with exploitation data such as KEV and EPSS.