The same flaw can score differently under CVSS 3.1 and 4.0 because the scoring method changed. Version 3.x used an algebraic formula. Version 4.0 maps vectors into equivalence sets ranked by experts, then compresses them onto the 0 to 10 scale. Do not compare numbers across versions as if they shared a scale.
What changed in the math
The CVSS v4.0 FAQ says the method for determining the number is new. It is a departure from the formula of 3.0 and 3.1. The result comes from expert ranking by members of the CVSS Special Interest Group, and the FAQ says directly that some scores will naturally differ between versions.
The user guide describes the build in steps. About 15 million CVSS-BTE vectors were gathered into 270 equivalence sets. Experts compared the sets with each other. The comparison data produced an ordering from least to most severe. Experts then chose where the qualitative boundaries fall, to stay backward compatible with the Low, Medium, High and Critical boundaries of 3.x. A small adjustment factor makes a change to any metric move the score slightly.
Why some different vectors share a score
There are 101 possible scores from 0.0 to 10.0 in steps of 0.1, and millions of vectors. Many must share a number. The FAQ shows four vectors that differ only in the Low or None values of the subsequent system metrics and all equal 9.3.
It also explains why User Interaction and Privileges Required can seem to have a small effect. They are grouped with Attack Vector combinations inside the equivalence sets, so there is limited room to separate them. The adjustment factor was capped at 0.1 to avoid disturbing the ranking.
What this means in practice
- Label the version. A stored score should carry its version and vector string, for example a vector starting with the text CVSS:4.0.
- Never average across versions. A 3.1 score and a 4.0 score on one record are two readings, not two samples of one.
- Do not expect the same band. A flaw that was High in 3.1 may land elsewhere in 4.0. The band is a hint, and your policy should rest on more than the band.
- Prefer the vector. The FAQ points out that the number does not carry the context that the full vector string does.
Which one will you see?
FIRST lists 4.0 as the current version, with 3.1, 3.0, 2 and 1 archived. You may still meet 3.1 scores on older records. Records can also hold more than one assessment from different sources. The FAQ notes these may differ for valid reasons, such as a vendor scoring its own platform, or because of errors, and it leaves the choice to the consumer. The SIG does not rule on which is right.
A sane policy
Pick one source of truth per field, write it down, and keep the rest as reference. For example: use the vendor assessment when it exists, otherwise the database's. Then layer exploitation and exposure data on top, since neither version of the base score knows about them.
Safeguard stores severity with reachability and fix data so a version difference in the base score does not decide your queue. Try the vulnerability management demo.
Quick check
Is CVSS 4.0 just 3.1 with new metrics?
No. The scoring method also changed, from an algebraic formula to expert ranked equivalence sets.
Can I compare a 3.1 score with a 4.0 score?
Not directly. Compare vectors and context, and keep the version with every stored score.
Sources
Last reviewed: 19 October 2026.
