CVSS

The Common Vulnerability Scoring System (CVSS), maintained by the Forum of Incident Response and Security Teams (FIRST), turns the technical characteristics of a vulnerability into a number. The base score considers questions such as: can it be exploited over the network, does it require user interaction or prior privileges, and how badly does it affect confidentiality, integrity and availability?

Scores map to severity ratings: Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0). The current version, CVSS v4.0, was published in 2023; many tools and databases still show v3.1 scores, so check which version you are reading.

Example

A remote code execution flaw in an internet-facing service that needs no authentication and no user interaction scores close to 10.0. A flaw that requires local access, an existing administrator account and a user clicking something scores much lower, even if the eventual impact is similar.

Why it matters for a SOC analyst

CVSS measures severity, not risk. A 9.8 on a system that is isolated and unused may matter less than a 7.5 on your VPN gateway that attackers are exploiting right now. Combine CVSS with exposure, asset importance and evidence of exploitation, such as CISA's Known Exploited Vulnerabilities catalog or FIRST's Exploit Prediction Scoring System (EPSS), before deciding what to fix first.