In CVSS 4.0 the vulnerable system is the thing that contains the flaw and from which it is exploited. Subsequent systems are everything else that suffers because of it. Impact is scored separately for each, so a flaw that harms only its own host reads differently from one that spills into neighbors.
Why the split exists
Earlier versions used a single Scope idea to hint at spillover. Version 4.0 makes it explicit in the Base impact metrics. Confidentiality, integrity and availability impact on the vulnerable system are written VC, VI and VA. The same three on subsequent systems are SC, SI and SA.
That lets a vector say two separate things: how bad it is for the component itself, and how bad it is for anything that depends on it.
The boundary rule
The FIRST FAQ gives two practical rules.
Vulnerable system. Consider the scope where the flaw exists and from which it will be exploited. Attack Vector, Attack Complexity, Attack Requirements, Privileges Required and User Interaction are all judged from there. If the flawed service is not able to stand on its own, the vulnerable system is the larger unit that contains it. An application with several integral services is reported as one application.
Subsequent systems. Anything that is not the vulnerable system but is affected by the flaw. If the service can be separated from the rest, for example the vendor ships both but one is not integral to the other, the service is the vulnerable system and the application becomes a subsequent system.
So the first question is always: can this component stand alone? If not, widen the boundary.
Worked examples from the FAQ
Cross-site scripting. The web application with the injection point is the vulnerable system. The user's browser is the subsequent system. That is why XSS often shows impact in the SC, SI or SA part of the vector.
SQL injection. It depends on the deployment. In a simple case the web application, the database and the direct impact all sit on one system, so there is no subsequent system impact. In a distributed case, the database holding the flaw is the vulnerable system, and other business applications that rely on its data are subsequent systems.
Safety and the subsequent side
The Environmental group lets a consumer set the modified subsequent impact to Safety, the highest level, when a device has an obvious potential to affect people. The FAQ cites a Bluetooth insulin pump as an example. This is a consumer decision, not something the base vector carries.
What to do with this when triaging
When you read a vector, compare the two impact triples. High on VC, VI and VA with None on the subsequent side describes a flaw that compromises the component but stays inside it. High on the subsequent side too tells you the blast radius is larger, so look at what depends on this component in your estate.
One more detail from the FAQ matters when you compare scores: several combinations of Low or None subsequent impact produce the same number. The score does not distinguish them, so read the vector, not just the digits.
Safeguard's SBOM and dependency scanning show which of your components pull in an affected package, which is the practical way to find your own subsequent systems. See the SCA dependency inventory demo.
Quick check
In an XSS flaw, which system is the subsequent system?
The user's browser. The web application containing the injection point is the vulnerable system.
What replaces Scope in CVSS 4.0?
The split between vulnerable system impact (VC, VI, VA) and subsequent system impact (SC, SI, SA).
Sources
Last reviewed: 19 October 2026.
