CVSS 4.0 supplemental metrics add context about a vulnerability without changing its numeric score. They cover Safety, Automatable, Provider Urgency, Recovery, Value Density and Vulnerability Response Effort. The vendor fills them in, and you decide how much weight each one gets when ordering a queue of equally scored findings.
Why a metric that changes nothing exists
The specification says no supplemental metric has any impact on the final score. The FAQ explains the purpose with a pair of examples. Two denial of service flaws can share the same number even though one recovers by itself and the other stays down until an administrator restarts it. The score hides that difference. The supplemental metric shows it.
Think of them as extra vocabulary for the vector string, not as extra points.
The six metrics
Safety has two values, Present and Negligible. Present means the consequences meet the IEC 61508 categories of marginal, critical or catastrophic. Negligible means minor injuries at worst. The specification notes that a missing Safety value does not mean there is no safety impact. It means nobody assessed it.
Automatable asks whether an attacker can reliably automate reconnaissance, weaponization, delivery and exploitation across many targets. A Yes aligns with wormable. The FAQ advises raising priority for automatable flaws, since defenders lose time between reports of exploitation and attacks on their own systems.
Provider Urgency is a pass-through rating from the supplier: Red, Amber, Green or Clear. The FAQ calls it the low order bits of severity. Among two flaws with the same base score, the one the vendor marks as more urgent may deserve the first slot.
Recovery records how the system comes back after an attack: Automatic, User or Irrecoverable.
Value Density is Diffuse or Concentrated. It describes the system holding the flaw, not the flaw itself. Concentrated systems are a more attractive target, so the FAQ says to fix those first when you are choosing across products.
Vulnerability Response Effort is Low, Moderate or High. It is a planning aid for how disruptive the fix will be, such as a firmware update that needs a reboot.
Who assigns and who acts
The specification separates two roles. The provider assigns supplemental values. The consumer decides what to do with them. A vendor marking a flaw Automatable does not force you to patch in any set time. It gives you a reason to consider it.
Using them in practice
You do not need a new tool to benefit. Add three columns to your triage sheet: Automatable, Provider Urgency and Safety. Use them only to break ties inside the same severity band. If a field is Not Defined, say so in the sheet instead of treating it as a quiet "no".
For operational technology or medical devices, put Safety first. For internet-facing services, Automatable is the one that tends to change what you do on day one.
Safeguard scans dependencies and containers and shows fix availability beside severity, which helps decide between two equally scored findings. The free scan is at gold.safeguard.sh/scan.
Quick check
Do supplemental metrics change the CVSS score?
No. The specification says no supplemental metric affects the final score, including CVSS-BTE.
Who should fill in Provider Urgency?
Any provider in the supply chain may, but the Penultimate Product Provider, the one closest to the consumer, is best placed to give a direct assessment.
Sources
Last reviewed: 19 October 2026.
