AC:H means the attacker needs more than a single repeatable step: conditions beyond their control must line up, such as winning a race or defeating a mitigation. CVSS 4.0 separates that idea into two metrics, Attack Complexity and Attack Requirements. Both lower urgency a little, but neither makes a finding safe.
The 3.1 definition
In CVSS 3.1, Attack Complexity describes conditions beyond the attacker's control that must exist to exploit the flaw. The specification gives examples of High: the attacker must gather knowledge about the environment, prepare the target (for example by winning a race condition or defeating exploit mitigations), or position themselves as a man in the middle. Low means there are no such conditions and the attack is repeatable. User interaction is excluded and scored separately.
| Value | Vector text | Reading |
|---|---|---|
| Low | AC:L | Repeatable, no special conditions |
| High | AC:H | Success depends on conditions the attacker must arrange or hope for |
The numeric constants are 0.77 for Low and 0.44 for High, so the High value cuts the exploitability sub-score sharply.
What 4.0 does differently
CVSS 4.0 keeps AC and adds AT, Attack Requirements, with values N and P. The spec distinguishes them this way.
| Metric | What it captures |
|---|---|
| AC | Measurable actions the attacker must take to evade or circumvent security-enhancing conditions. It does not measure time or the number of attempts |
| AT | Deployment and runtime conditions that enable the attack. They are not meant to mitigate attacks. Without them, the attack may succeed only occasionally or not at all |
In other words, AC is about the attacker defeating a defense, and AT is about the target being in the right state. A vector string beginning CVSS:4.0/ therefore has both AC and AT in it, while one beginning CVSS:3.1/ has only AC.
How to read it in a scan
- Check the prefix. If the vector starts with CVSS:3.1, one metric covers this idea. If it starts with CVSS:4.0, read AC and AT together.
- For AC:H, find the condition in the advisory text. A race condition, a specific configuration or a man in the middle position each carry different real-world odds.
- For AT:P in 4.0, find the required deployment condition. Ask whether your deployment meets it. A flaw that only works with a non-default setting may not apply to you at all.
- Treat High complexity as friction, not a wall. Skilled attackers and shared exploit tooling lower the effort over time.
The trap of "hard to exploit"
Complexity is judged when the vector is written. It does not track what happens afterwards. If a public exploit later makes the attack easy to repeat, the AC:H in the record may stay as it was, while temporal or threat information in other signals changes. That is one reason to read exploitation evidence alongside the vector.
A useful rule of thumb
If AC:H or AT:P hinges on a configuration, check your configuration and move on if it is not present, and record that. If it hinges on timing or luck, do not rely on it as a defense. A repeatable race can be run many times.
Safeguard's zero-day discovery and reachability analysis give you code-level context on top of the vector, so you can see whether the vulnerable path is called in your project. A free scan is at gold.safeguard.sh/scan.
Quick check
Does CVSS 3.1 have an Attack Requirements metric?
No. Attack Requirements (AT) was added in CVSS 4.0, which also keeps Attack Complexity.
Does AC:H measure how long the attack takes?
No. Complexity concerns conditions the attacker cannot control, and in 4.0 the spec says AC does not measure time or number of attempts.
Sources
Last reviewed: 19 October 2026.
