What Is CVSS (Common Vulnerability Scoring System)?

Definition

CVSS (Common Vulnerability Scoring System) is an open standard, maintained by FIRST, that rates the severity of a software vulnerability on a scale from 0 to 10. The score summarizes how easy a flaw is to exploit and how much damage it could do. CVSS measures severity, not the risk to your particular business.

How It Works

The current version, CVSS v4.0, groups its measurements into four metric groups:

Base: the flaw's built-in characteristics, such as whether it can be exploited over the network, whether the attacker needs an account, and the impact on confidentiality, integrity, and availability. The FIRST specification says the Base Score "assumes the reasonable worst-case impact across different deployed environments."
Threat: adjusts for factors such as public exploit code or active exploitation.
Environmental: adjusts for your setup, such as existing mitigations and how critical the system is.
Supplemental: "additional extrinsic attributes" that add context, such as safety impact.

Scores map to ratings: 0.0 is None, 0.1 to 3.9 is Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, and 9.0 to 10.0 Critical. The published number is usually the Base Score alone. FIRST advises consumers to add Threat and Environmental values to produce "a more comprehensive input to risk assessment specific to their organization."

CISA makes the same point. Its June 2026 directive for federal agencies, BOD 26-04, ranks urgency by public exposure, known exploitation, exploit automation, and technical impact, and notes that technical impact "is similar to" the CVSS base score's concept of "severity." Severity is one factor, not the whole answer.

Real-World Example

CVE-2023-4966, nicknamed Citrix Bleed, affected Citrix NetScaler remote access appliances. The NIST National Vulnerability Database lists two CVSS v3.1 base scores for it: 9.4 Critical from Citrix and 7.5 High from NVD. A team sorting only by NVD's number might have queued it behind other "critical" items. Yet a joint CISA and FBI advisory reported exploitation "as early as August 2023," before the October 10 disclosure, and LockBit 3.0 affiliates used it to hijack sessions and bypass MFA, including at Boeing Distribution Inc.

Why It Matters for a Small Business

Vulnerability scanners and vendor bulletins sort findings by CVSS, so it is often the first number a small business sees. It is a sensible starting point, but treating it as a to-do list ordered by score leads to wasted effort on flaws that are hard to exploit and slow action on ones attackers are already using. A small business with limited IT time gets more protection by asking three questions of each finding: is the system reachable from the internet, is the flaw known to be exploited, and what would we lose if it were compromised?

How to Spot It / How DTS Handles It

You will see CVSS scores in scan reports and vendor advisories, often as a vector string beginning "CVSS:4.0/" or "CVSS:3.1/". Watch for reports ranked only by score, with no note of which findings face the internet or are already being exploited.

DTS can help with using CVSS as one input, then raising the priority of anything internet-facing or in CISA's Known Exploited Vulnerabilities catalog. See our managed IT service.

Related Terms

CVE: the flaw a CVSS score describes.
CISA KEV catalog: flaws known to be exploited, whatever their score.
EPSS: a probability of exploitation, a complement to CVSS.
Patch management: where scores feed priority.
Vulnerability scanning: scan reports usually sort by CVSS.
Session hijacking: what Citrix Bleed enabled.

Sources

FIRST, Common Vulnerability Scoring System v4.0: Specification Document: https://www.first.org/cvss/v4-0/specification-document
NIST National Vulnerability Database, CVE-2023-4966 Detail: https://nvd.nist.gov/vuln/detail/CVE-2023-4966
CISA, FBI, MS-ISAC and ASD's ACSC, #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability, AA23-325A (November 21, 2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (June 10, 2026): https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Last updated October 14, 2026.