A CVSS vector string is a compact list of the conditions behind a score: how the attacker reaches the target, how hard it is, what privileges and user action are needed, and what is damaged. Reading it takes two minutes and often tells you more about your risk than the number alone.
An example
A CVE page on Gold showed this vector for a score of 7.8: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The first part names the version, 3.1. The rest are metric and value pairs.
The exploitability metrics
AV is attack vector. N means network, A adjacent, L local and P physical. In the example, AV:L means the attacker needs local access. That narrows who can exploit it remotely.
AC is attack complexity. L means low, so no special conditions are needed. H means high.
PR is privileges required. N for none, L for low, H for high. PR:L means some account is needed.
UI is user interaction. N means no one has to click anything. R means a user must act.
Scope and impact
S is scope. U means unchanged, so the impact stays within the vulnerable component. C means changed, so it can affect other components.
C, I and A are impact on confidentiality, integrity and availability. H is high, L low and N none. The example had high on all three, which is why the score is high even with a local vector.
Why the vector beats the score
FIRST describes the base score as a measure of severity from intrinsic characteristics, and says it should not be used alone to assess risk. Two CVEs can both score 7.8 for very different reasons. One may be network reachable with no login. Another may need a local account. For a server with no local users, the second is far less urgent.
Questions the vector helps you answer
- Can an outsider reach it? Look at AV.
- Do they need an account? Look at PR.
- Does it need a victim to act? Look at UI.
- What is lost if it works? Look at C, I and A.
Combine this with EPSS and the CISA KEV catalog, as FIRST and CISA suggest.
A quick exercise
Take the last five CVEs from your scan. Write the AV, PR and UI values next to each. Sort network, no privileges, no interaction first. That simple pass often changes the order.
Test it with a demo
Click through it at your own pace, or open it full screen.
For a manifest level view of which packages have CVEs at all, start at gold.safeguard.sh/scan. Safeguard's reachability analysis then helps with whether your code uses the affected function.
Quick check
Does AV:L mean I can ignore it?
No. Local flaws matter where attackers can get local access, such as shared hosts, CI runners or after another compromise.
Sources
Last reviewed: 19 October 2026.
