The last three codes in a CVSS 3.1 vector are C, I and A: loss of confidentiality, integrity and availability. Each is High, Low or None. High means total loss or a serious direct consequence, Low means limited loss, None means no loss within the impacted component. Together they describe what an attacker gets.
Definitions
The 3.1 specification describes the worst outcome for the impacted component.
| Value | Vector text | Meaning |
|---|---|---|
| High | C:H, I:H, A:H | Total loss, such as all resources exposed, all protected files modifiable, or availability fully denied. A partial loss also counts as High if it has a direct, serious impact, such as stolen administrator credentials |
| Low | C:L, I:L, A:L | Some loss, with limited control or scope, and no direct serious consequence |
| None | C:N, I:N, A:N | No loss within the impacted component |
The three letters map to a familiar triad.
- Confidentiality: who can read data they should not.
- Integrity: who can change data or behavior they should not.
- Availability: who can stop the component from working.
Decoding a real shape
Take this vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
It ends in C:L, I:L, A:N. A reader can say: some data can be read, some can be changed, nothing is knocked offline, and the attacker needs high privileges to start. The impact segment is quiet. That fits a medium severity, not an emergency.
Now compare C:H, I:H, A:H with PR:N. The same reader would say: an unauthenticated attacker can read everything, change everything and take the service down. That is the top of the scale.
Reading the impact pattern
The mix of letters often tells you more than the label.
- C:H with I:N and A:N is a data exposure. Your questions are which data, and whether it is regulated or secret.
- I:H with C:N is tampering. Think about build integrity, stored configuration and anything other systems trust.
- A:H alone is a denial of service. The question is whether downtime is costly for this component and whether your platform restarts or scales around it.
- All three High usually means code execution or full takeover. Treat it with the most care, then check the other metrics for how hard it is to reach.
Impact is about the component
The specification scores loss for the impacted component, and Scope decides whose component that is. If scope is unchanged the impacted component is the vulnerable one. If it is changed, the impact may fall on another authority. Read the S metric just before the impact letters.
Putting your own data into it
A scanner assigns C, I and A for a reasonable worst case. You know what the component actually holds. A service that stores nothing sensitive makes a C:H less meaningful. A service that guards payment tokens makes even C:L worth a look. The specification recommends supplementing the base score with environmental information for this reason, and its modified impact metrics exist so you can restate the impact for your own setting.
A quick habit
When you open a finding, read the vector right to left. Start with C, I, A: what is lost? Then S, UI, PR, AC, AV: how hard is it to get there? You end up with a sentence you can say aloud: "an unauthenticated attacker over the network can read all data". That sentence is what you compare against your environment.
Safeguard's compliance and evidence automation can attach your triage notes to findings, so the reasoning behind a changed priority is kept with the record. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Open a finding and read its impact before its label.
Quick check
What does A:N mean?
It means no loss of availability within the impacted component. The flaw may still expose or change data.
Is C:L harmless?
Not always. Low means some loss with limited scope, but if the data involved is sensitive in your system, even a limited read can matter.
Sources
Last reviewed: 19 October 2026.
