A CVSS vector string is a compact line such as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. Each pair is one base metric: how the attack is delivered, how hard it is, what access it needs, and how badly confidentiality, integrity and availability are hit.
The eight base metrics
The CVSS 3.1 specification from FIRST defines these base metrics and their allowed values.
| Code | Metric | Values |
|---|---|---|
| AV | Attack Vector | N, A, L, P |
| AC | Attack Complexity | L, H |
| PR | Privileges Required | N, L, H |
| UI | User Interaction | N, R |
| S | Scope | U, C |
| C | Confidentiality impact | H, L, N |
| I | Integrity impact | H, L, N |
| A | Availability impact | H, L, N |
The letters are short for words. For attack vector, N is network, A is adjacent, L is local and P is physical. For the impact metrics, H is high, L is low and N is none. For scope, U is unchanged and C is changed.
Decode one example
Take the example from the spec: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. Read it left to right.
- CVSS:3.1 is the version of the scoring system.
- AV:N means it can be attacked over a network.
- AC:L means low complexity, so no special conditions are needed.
- PR:H means the attacker needs high privileges, for example an administrator account.
- UI:N means no user has to click anything.
- S:U means the impact stays within the same security scope.
- C:L and I:L mean limited loss of confidentiality and integrity.
- A:N means availability is not affected.
In one sentence: a remote attacker with an admin account can read and change a little data, and cannot cause an outage. That reads very differently from a bare number.
Turn the number into a label
FIRST publishes a qualitative scale: None is 0.0, Low is 0.1 to 3.9, Medium is 4.0 to 6.9, High is 7.0 to 8.9 and Critical is 9.0 to 10.0. The score is calculated from the vector, so you can always re-derive the meaning from the letters.
What the vector cannot tell you
The base score describes the flaw in general. It does not know whether your service exposes the vulnerable function, whether the flaw is being exploited in the wild, or whether a fix exists. That is why teams pair severity with other signals. Our explainer on CVE, CVSS, EPSS and SSVC compared covers those.
Practice routine
Pick three advisories this week. Before reading the score, decode the vector and write the sentence. Then compare your sentence with the stated impact. After ten advisories you will read vectors without a lookup table.
Try it yourself
Open the demo and look at how an exploitability check changes what you do with a finding that has a high base score.
Click through it at your own pace, or open it full screen.
Quick check
Does a higher CVSS score always mean fix it first?
No. Context matters, including exposure, known exploitation and whether the vulnerable code is reachable.
What does AV:L tell you?
The attacker needs local access to the machine, so remote exploitation is not the default path.
Sources
Last reviewed: 19 October 2026.
