A critical severity score means a flaw would be very serious if exploited, in general. It does not mean your company is in danger today. The scoring body says base scores should not be used alone to assess risk. Pair the score with evidence of exploitation and your own exposure.
What the score is
CVSS, the common scoring system, rates the severity of a vulnerability. FIRST's user guide says base scores reflect the inherent traits of a flaw regardless of threats or the environment. It lists High as 7.0 to 8.9 and Critical as 9.0 to 10.0. Think of it as a hazard label on a chemical, not a forecast of an accident at your site.
What the score leaves out
FIRST states that base scores measure severity, not risk, and that threat and environmental information should supplement them. The score does not know whether the flawed code runs in your product, whether the system is reachable from the internet, or whether attackers are using the flaw.
Three extra signals that change the answer
| Signal | Question | Source type |
|---|---|---|
| Exploitation evidence | Is it being used in attacks? | CISA KEV catalog |
| Likelihood estimate | How probable is exploitation soon? | EPSS |
| Your exposure | Does our code use it and is it reachable? | Your own analysis |
CISA describes its KEV catalog as the authoritative source of vulnerabilities exploited in the wild and recommends using it as one input to prioritization. FIRST describes EPSS as an estimate of the probability a published flaw will be exploited in the next 30 days.
A simple way to brief a leader
Report three numbers instead of one: how many findings are critical, how many of those are known exploited, and how many are reachable in your products. The third number is usually much smaller than the first, and it tells you where to put engineers first.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, and its reachability analysis shows which findings your code actually uses. You can run a free scan on a repository to see an inventory for yourself.
Try it yourself
Open a finding and compare its severity with the exploitability signals shown next to it.
Click through it at your own pace, or open it full screen.
Quick check
Should we ignore low scores?
No, but order work by exposure. A medium flaw on an internet facing system that is known exploited can matter more than a critical one in unused code.
Is EPSS a replacement for CVSS?
No. They answer different questions. CVSS rates severity; EPSS estimates likelihood of exploitation.
Sources
- FIRST, CVSS v4.0 User Guide
- CISA, Known Exploited Vulnerabilities Catalog
- FIRST, Exploit Prediction Scoring System
Last reviewed: 19 October 2026.
