CVSS, the Common Vulnerability Scoring System, is a published standard that captures the main characteristics of a vulnerability and produces a numerical severity score. The score maps to qualitative levels of low, medium, high and critical, which helps teams prioritize. It describes severity, not the chance of attack.
What the score is built from
A CVSS score comes from answering structured questions about a flaw: how an attacker reaches it, how hard it is to exploit, what privileges are needed, and what the impact would be. The same inputs always produce the same number, which is why the score is useful for comparing flaws across products.
FIRST, the organization behind the standard, lists CVSS v4.0 as the current version, with v3.1, v3.0, v2 and v1 archived. You will still see v3.1 scores on many records, so check which version a number came from before comparing two of them.
What CVSS does not tell you
CVSS answers "how bad could this be?" It does not answer "is anyone using it?" or "can it be reached in my code?" Two vulnerabilities with the same score can deserve very different urgency.
That is why teams pair it with other signals:
- exploitation likelihood, such as EPSS
- confirmed exploitation in the wild, such as the KEV catalog
- whether the vulnerable code is reachable in your application
A practical way to use it
Use CVSS as a first filter, not the final decision. A critical score on a component that never runs in production can wait behind a medium score on an internet-facing path that is being exploited.
Write down your rule so it is repeatable. For example: anything on the KEV catalog goes first, then reachable criticals, then everything else by score. The exact order is your call, but the order should exist before the next alert arrives.
Common mistakes
- Treating the number as a deadline. The score does not set a fix date. Your policy does.
- Comparing scores across versions as if they were the same scale.
- Ignoring unscored or recently published entries because the score is missing.
Safeguard shows severity next to reachability and fix availability so the score is one input among several. A free scan is at gold.safeguard.sh/scan.
Quick check
Is a higher CVSS score always more urgent?
No. It means higher potential impact. Urgency also depends on exploitation, exposure and reachability.
Does CVSS predict whether a flaw will be exploited?
No. That is what a separate model such as EPSS estimates.
Sources
Last reviewed: 19 October 2026.
