No. A CVSS score rates the severity of a vulnerability relative to other vulnerabilities. It does not measure the risk to any one organization. The FIRST specification says so in effect: other factors, such as regulatory requirements and monetary losses, are outside the scope of CVSS.
Severity and risk, defined
Severity describes how bad a flaw is in general terms: what an attacker gains and how easily. Risk describes what that flaw means for a particular business, given where the software runs, what data it touches and who can reach it.
The CVSS v4.0 specification calls its outputs "numerical scores indicating the severity of a vulnerability relative to other vulnerabilities." It says consumers can enrich the Base score to produce a score that is a more comprehensive input to risk assessment specific to their organization.
So the score is an input. The decision is still yours, or your customer's.
Why vendors should say this out loud
When a customer sees a Critical rating, the support queue fills. If your advisory explains that the score is generic and says whether your product is actually exposed, you answer the real question first.
Customers ask three things:
- Does this affect the version I run?
- Is it being exploited?
- What should I do, and by when?
A number answers none of them. Your advisory has to.
Wording you can adapt
Put one short paragraph under the score. For example: "This score describes the flaw in general. It does not account for how you deploy the product. Customers who run the affected component behind authentication, or who have not enabled the affected feature, may face lower exposure. Our guidance below says how to check."
Then give the check, with a command or a setting name, and a clear statement of fixed versions.
What to include next to the score
| Item | Why a customer needs it |
|---|---|
| Affected and fixed versions | Lets them decide if they are in scope |
| Whether exploitation is known | Sets urgency |
| Conditions needed for the flaw to be reachable | Lets them judge exposure |
| Workaround, if any | Gives a path before they can patch |
| Date and revision | Shows how current the advice is |
A note on the rating words
The specification maps scores to None, Low, Medium, High and Critical, with Critical starting at 9.0, and says use of these ratings is optional. If you use the words, use them consistently and keep the number visible. See our post on labeling scores for the nomenclature.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how exploitability context changes how urgent a finding looks compared with its score alone.
Quick check
Is a Critical CVSS score always urgent for me?
Not automatically. It signals high severity in general. Urgency depends on whether you run the affected code, whether it is reachable, and whether exploitation is known.
Are the Low to Critical words mandatory?
No. The specification says the qualitative ratings are optional when publishing CVSS scores.
Safeguard's reachability analysis and exploitability context help teams judge whether a flaw matters in their own code. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
