The short answer
CVSS, the Common Vulnerability Scoring System, rates the technical severity of a vulnerability from 0.0 to 10.0. It is maintained by FIRST, and the current version, CVSS v4.0, was released in November 2023. Scores of 7.0 to 8.9 are High and 9.0 to 10.0 are Critical. CVSS measures severity, not your business risk.
On this page
CVSS (the Common Vulnerability Scoring System) is the open standard for rating how severe a software vulnerability is, on a scale from 0.0 to 10.0. It is maintained by FIRST, the Forum of Incident Response and Security Teams, and the current version is CVSS v4.0, released in November 2023. Vendors, databases, scanners and testers all use it, so scores are comparable across advisories and reports, as long as the version is quoted.
What is a CVSS score?
A CVSS score is calculated from metrics that describe a vulnerability: how it is reached, how hard it is to exploit, what privileges and user action it needs, and what it does to confidentiality, integrity and availability, the three properties of the CIA triad. The values are recorded in a vector string, so anyone can check the number in FIRST’s official CVSS calculator.
Take a flaw exploitable across the internet with no login or user action that fully compromises the system. In CVSS v3.1 its vector is CVSS:3.1/, which scores 9.8. In CVSS v4.0 the same flaw is CVSS:4.0/, which scores 9.3. Both are Critical, but the versions calculate differently, so always quote the version with the number.
What is a high CVSS score?
A score of 7.0 to 8.9 is High and 9.0 to 10.0 is Critical. CVSS v3.x and v4.0 share these bands, and some schemes set rules at them. Older CVEs scored only under CVSS v2 may show 7.0 to 10.0 as High, because the v2 bands used by the US National Vulnerability Database had no Critical rating.
| Rating | Score | Where the threshold matters |
|---|---|---|
| None | 0.0 | No action needed |
| Low | 0.1 to 3.9 | Usually fixed in routine maintenance |
| Medium | 4.0 to 6.9 | A PCI ASV scan fails on any vulnerability with a base score of 4.0 or more, unless the ASV accepts a dispute |
| High | 7.0 to 8.9 | Cyber Essentials: updates fixing a CVSS v3 base score of 7 or more are due within 14 days |
| Critical | 9.0 to 10.0 | The same 14-day rule applies; these go to the top of any fix plan |
What changed in CVSS 4.0?
CVSS 4.0, written v4.0 in the specification and in vector strings, reorganised the metrics into four groups, set out in the FIRST CVSS specification.
| Metric group | What it covers | Changes the score? |
|---|---|---|
| Base | Attack vector, attack complexity, the new attack requirements metric, privileges required, user interaction (now passive or active), and impact on the vulnerable system and on subsequent systems | Yes |
| Threat | Exploit maturity: whether attacks have been reported, a proof of concept exists, or neither. Replaces the v3.1 temporal group | Yes |
| Environmental | How much confidentiality, integrity and availability matter for the affected asset, plus any base values you adjust for your environment | Yes |
| Supplemental | Extra context such as safety, automatable, recovery, value density, response effort and provider urgency | No |
The scope metric has gone, replaced by those separate impacts. Scores are labelled by the groups they include: CVSS-B for base only, CVSS-BT with threat, CVSS-BE with environmental, and CVSS-BTE with all three. Many advisories still publish v3.1 scores, so expect to see both.
How do CVSS scores appear in a penetration testing report?
Each finding in a penetration testing report should carry a severity rating, usually based on CVSS. Look for the score, the vector string and any adjustment for your environment, with the reason stated.
Our penetration test reports give risk ratings mapped to CVSS and to business impact, because a medium-scored flaw on your payment page can deserve more urgency than a high-scored one on an isolated test server. Flaws in bespoke code have no CVE, so the tester scores them; for known product vulnerabilities, vulnerability scanning tools report the published score.
Where do Cyber Essentials and PCI DSS use CVSS?
- Cyber Essentials. Under the NCSC’s Requirements for IT Infrastructure v3.3, an update must be installed within 14 days of release if the vendor rates it critical or high risk, if it fixes a vulnerability with a CVSS v3 base score of 7 or above, or if the vendor gives no severity. Our Cyber Essentials checklist covers the rest of the rule.
- PCI DSS v4.0.1. Requirement 6.3.1 asks you to give new vulnerabilities a risk ranking based on industry best practice and potential impact, identifying at least everything high-risk or critical. It does not mandate CVSS, but CVSS is the usual starting point. Requirement 6.3.3 then requires patches for critical vulnerabilities within one month of release, and internal scans under 11.3.1 must show high-risk and critical vulnerabilities resolved. ASV scans apply the 4.0 threshold plus some automatic fails, as our guide to passing a PCI ASV scan explains.
Is a CVSS score the same as risk?
No. FIRST describes CVSS as a measure of severity, not risk: it says how bad a flaw could be, not how likely it is to be exploited or what it would cost you. For likelihood, EPSS estimates the probability of exploitation in the next 30 days, and vulnerability management brings both into a process with owners and deadlines. A CTEM programme goes further, ranking exposures by attack paths and business impact, and testing whether they can really be exploited.
Why Sovereign Secure?
We are a PCI SSC Qualified Security Assessor (QSA) company and ISO 27001 certified. We test web applications, APIs, networks, cloud, mobile apps, hardware and IoT, wireless, social engineering, red team, source code and AI/LLM systems, and run vulnerability scanning.
For more definitions, browse our cyber security glossary. To scope a test, request a quote through our penetration testing quote form or call +44 161 523 5276.
Your next step
- Scope your testChoose your test types and asset counts online to scope your penetration test.Scope your test
- Pen testing cost guideUK day rates, price ranges by test type and what drives the cost.Read the cost guide
- Talk to a testerTell us what you need tested. We aim to reply within one working day.Talk to a tester
Last reviewed October 2026 by the Sovereign Secure assessment team.
