What is CVSS and how should you read a score?

The Common Vulnerability Scoring System, CVSS, is an open framework for describing the characteristics and severity of a software vulnerability as a score from 0 to 10 plus a vector string. It measures severity, not your risk. Use the score as one input beside exposure, exploitation evidence and asset value.

What are the parts of a CVSS 4.0 score?

The FIRST specification for version 4.0 defines four metric groups: Base, Threat, Environmental and Supplemental.

Base metrics capture the intrinsic qualities of a vulnerability that stay constant over time and across environments. These produce the number most people quote.

Threat metrics reflect characteristics that change over time, such as whether exploit code exists. Environmental metrics reflect your own setting, for example how critical the affected system is to you or what controls already limit it. Amending the Base score with Threat and Environmental values refines it.

Supplemental metrics do not change the score. They carry extra context, such as a Safety value for systems that can affect physical harm, and they are optional for scoring providers to supply. The consumer decides what weight, if any, to give them.

Why do the labels CVSS-B and CVSS-BTE matter?

Version 4.0 asks that a score name which groups produced it: CVSS-B for Base only, CVSS-BT for Base plus Threat, CVSS-BE for Base plus Environmental, and CVSS-BTE for all three. This matters because a public database score is typically Base only. If you see "9.3 Critical" with no label, assume it is a Base score for the worst plausible deployment and says nothing about whether anyone is exploiting it.

Is a high CVSS score the same as high risk?

No, and the specification says so in its own words. It invites consumers to use CVSS as input to an organisational vulnerability management process that also weighs other factors, naming regulatory requirements and the number of customers affected among them.

Consider a constructed pair of findings. Finding one is a 9.8 in a parsing library that your application bundles but never calls on untrusted input, running in an internal batch job with no network exposure. Finding two is a 6.5 in your public login service, with a working exploit circulating. By Base score, finding one wins. By any sensible reading of risk, finding two does. This is the gap Threat and Environmental scoring exist to close, and the gap that reachability and exploitability data fill.

A second trap is that two scorers can disagree. The NVD record for a CVE can carry a score from the CNA that assigned it and, separately, one from NVD analysts. Check which source produced the number and which version of CVSS was used. Versions 3.1 and 4.0 are not directly comparable.

How do you use CVSS well?

Treat it as a common language between vendors, scanners and your own teams, not as a queue order. A score lets two people describe a flaw in the same terms. It does not tell you what to fix first on Monday.

Where your tools allow it, record the vector string, not only the number. The vector shows attack vector, complexity, privileges, user interaction and impact, which are the facts you can check against your own architecture.

How to check or apply this

1. When you read a score, note the version (3.1 or 4.0), the source, and the label (B, BT, BE or BTE).
2. Open the vector and ask three questions: can an attacker reach it from where they are, what privilege do they need, and what do they gain?
3. Add Threat context. Is exploitation reported, and is the flaw in a known exploited list?
4. Add Environmental context. Is the component reachable in your deployment, and which data or function sits behind it?
5. Define your own rule, for example fix within a set number of days for reachable and exploited, and a longer window otherwise. Write it down.
6. Re-score when facts change, such as a new public exploit.

Quick check

Sources

• FIRST, CVSS v4.0 Specification Document
• NVD record for CVE-2026-29000, showing a CNA supplied CVSS 4.0 score

Last reviewed: 18 October 2026.