Severity in a scanner is borrowed data. When the source, such as a CNA or NVD, publishes a new score, corrects an error or adds enrichment, your scanner's number changes on its next refresh. Your policy should expect that, and gates based on a fixed number need a review process.
Where the number comes from
A scanner usually shows a CVSS score taken from a public source. That source may be the CVE record's own assigner (the CNA), NVD's analysis, or a database that adds its own rating. When two sources disagree, the scanner picks one by rule, and the rule differs between tools.
The NIST NVD page gives a recent example. On 28 April 2026 NVD announced a correction of about 4,500 CVSS v4.0 scores that had been too high. It also says it no longer routinely provides its own severity score for CVEs that already have one from the CNA. Both changes can move a displayed severity.
Common causes
| Cause | What you see |
|---|---|
| Source corrected an error | Score drops or rises with no new advisory |
| Enrichment arrived late | A finding that had no score gets one |
| Scanner switched source priority | Many findings change on the same day |
| CVSS version changed | Version 3.1 and 4.0 scores are not directly comparable |
| Advisory edited | Affected versions or severity updated |
How to investigate
- Open the finding's history if your tool keeps it. If it does not, that is a gap to raise.
- Check the original record in a public source for edits and dates.
- Read your scanner's release notes for changes in data sources or scoring rules.
- Compare with a second source to see whether the change is real or an artefact.
- Record what you found, so the next surprise is easier.
What to put in policy
- Gate on more than a single score. Combine severity with exploitation evidence such as KEV, and with reachability.
- Define a grace period for findings whose severity rises overnight, so a pipeline does not block every team without warning.
- Keep a record of the source and value used when a decision was made. An auditor may ask why a finding was accepted at a given time, and "the score was lower then" is only believable if you have the record.
- Make the owner responsible for reading data source change notices.
Open source versus managed
With an open source tool, source selection is documented in the project, so read it and watch its release notes. With a managed platform, ask whether severity changes are logged, how users are notified, and whether you can pin a scoring approach. Our guide on CVSS 4 attack complexity vs attack requirements helps with version differences.
Safeguard combines reachability analysis with dependency scanning so severity is not the only signal, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Is a severity drop a reason to close a finding?
Not automatically. Check why it dropped, and whether the vulnerable code is reachable and exposed.
Do CVSS 3.1 and 4.0 scores match?
No. They use different metrics, so do not compare the numbers directly.
Sources
Last reviewed: 19 October 2026.
