Label every CVSS number in your advisory with the nomenclature that shows which metric groups produced it: CVSS-B for Base only, CVSS-BT with Threat, CVSS-BE with Environmental, CVSS-BTE with all three. The CVSS v4.0 specification says scores should be labeled this way so readers know what the number means.
Why labels matter to customers
A bare "9.3" tells a customer very little. Is it the vendor's generic score, or one adjusted for known exploitation? A customer comparing your advisory with a scanner report may see two different numbers for the same flaw and wonder who is wrong. Often nobody is. The two scores were built from different metric groups.
A label removes the argument before it starts.
What each label means
| Label | Metric groups used | Who usually produces it |
|---|---|---|
| CVSS-B | Base | Vendor or a public database |
| CVSS-BT | Base and Threat | Anyone with exploit information |
| CVSS-BE | Base and Environmental | The customer, for their own setup |
| CVSS-BTE | Base, Threat and Environmental | The customer, with full context |
The specification notes that providers such as the National Vulnerability Database typically publish only Base scores, which it calls CVSS-B. It also says that in version 4.0, Base, Threat and Environmental values are always considered in the final calculation, with unspecified values defaulting to Not Defined.
How to write it in an advisory
Put the label, the number, and the vector string together on one line. For example: CVSS-B 9.3 (Critical) followed by the full vector. Then add a plain sentence about what the score does not include.
Steps:
- Compute the Base score for the flaw in your product, not in the upstream library alone.
- Write it as CVSS-B and include the vector so anyone can reproduce it.
- If you know about exploitation, add a separate CVSS-BT line and say where that information came from.
- Tell customers that Environmental metrics depend on their deployment, and that they can compute CVSS-BE for themselves.
- Date the advisory and update the score line if the inputs change.
What not to do
- Do not publish a number with no label and no vector.
- Do not mix scores from different versions of CVSS in one line without naming the version.
- Do not present a Base score as a measure of how likely an attack is. The specification describes scores as severity relative to other vulnerabilities, a point covered in more depth in our post on CVSS severity versus risk.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a finding carries a score alongside context, and think about which label each number would need.
Quick check
What does CVSS-B mean?
A score generated from Base metrics only. The specification says public providers such as the National Vulnerability Database typically publish only these.
Who should compute the Environmental score?
The customer, because it reflects their own deployment. A vendor can explain how, but cannot know each environment.
Safeguard's dependency scanning and reachability analysis show customers which advisories matter in their own code, which is the context a Base score cannot give. There is a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
