A CVSS score of 9.0 to 10.0 is Critical, 7.0 to 8.9 is High, 4.0 to 6.9 is Medium, 0.1 to 3.9 is Low, and 0.0 is None. These bands come from the FIRST CVSS v4.0 specification, which also says using the words is optional.
The table
| Rating | CVSS score |
|---|---|
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |
The specification says all CVSS scores, whatever their nomenclature, can be mapped to these ratings. That includes Base only scores, scores with Threat metrics, and scores with Environmental metrics.
What the bands are for
The bands are a shorthand for readers who do not want to interpret a decimal. A support engineer scanning an advisory can see "High" and understand the general weight of the issue.
They are not a service level. The specification does not say a Critical must be fixed in a set number of days. Your own policy decides that, and it should be stated in your advisory or your security page.
Using the bands in your communications
Steps for a vendor:
- Decide whether you will use the words at all. The specification says there is no requirement to include them.
- If you do, publish the number next to the word, never the word alone.
- Use the same mapping in every advisory, so customers can compare over time.
- State which metric groups the score used. Our post on labeling scores explains the labels.
- Add the context a band cannot carry: affected versions, exploitation status and workarounds.
Common misreadings
- A 6.9 and a 7.0 sit in different bands even though they are almost identical. Do not treat the boundary as a cliff.
- Two scores for one flaw may differ because they used different metric groups, not because one is wrong.
- A High score on a library you ship but never call may matter less than a Medium score on code that handles untrusted input. The score does not know which is which. See severity versus risk.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how many high severity findings remain once reachability is taken into account.
Quick check
Is 9.0 Critical?
Yes. The Critical band starts at 9.0 and runs to 10.0.
Do I have to use the rating words?
No. The specification says the qualitative ratings are optional and there is no requirement to include them when publishing CVSS scores.
Does Critical mean fix within a fixed number of days?
Not in CVSS. Timelines come from your own policy or from contracts.
Safeguard's vulnerability management and reachability analysis let teams sort findings by exposure as well as score. You can run the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
