How to Read a CVSS Vulnerability Score

Security advisories often show a CVSS score, a number from 0 to 10 describing severity. Knowing how to read a CVSS score helps you prioritize patches sensibly.

What CVSS measures

The Common Vulnerability Scoring System rates how easily a flaw can be exploited and how severe the impact would be on confidentiality, integrity, and availability.

Severity ranges

Scores of 9.0 to 10.0 are critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, and below that low. The vector string shows details such as network access and required privileges.

Limits of the score

CVSS measures technical severity, not your specific risk. A high score on an isolated system may matter less than a medium one on an internet-facing server.

Add context

Consider whether the flaw is being exploited, whether exploit code is public, the exposure of the asset, and the data it holds. Lists of known exploited vulnerabilities help.

Build a workflow

Triage by exposure and exploitation first, then score, and set deadlines by priority.

Key takeaways

• What CVSS measures: The Common Vulnerability Scoring System rates how easily a flaw can be exploited and how severe the impact would be on confidentiality, integrity, and availability.
• Severity ranges: Scores of 9.0 to 10.0 are critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, and below that low. The vector string shows details such as network access and required privileges.
• Limits of the score: CVSS measures technical severity, not your specific risk. A high score on an isolated system may matter less than a medium one on an internet-facing server.
• Add context: Consider whether the flaw is being exploited, whether exploit code is public, the exposure of the asset, and the data it holds. Lists of known exploited vulnerabilities help.
• Build a workflow: Triage by exposure and exploitation first, then score, and set deadlines by priority.

Putting it into practice

To apply this in your own organization, begin with a short assessment of where you stand on CVSS score today. Write down who owns it, which tools are involved, and the single biggest gap. Fix the highest-risk gap first, assign a clear date, and review progress after thirty days. Share what you learn with the team so improvements stick, and document the decisions you make so new staff can follow them. Revisit the topic every quarter, because threats, tools, and business needs change quickly, and small regular adjustments are far easier than large emergency fixes.

Common mistakes to avoid

Many teams struggle with CVSS score because they try to do everything at once, skip documentation, or treat it as a one-time project. Others rely on a single person who holds all the knowledge, or buy tools before defining the problem they need to solve. Avoid these traps by starting small, writing down simple procedures, spreading responsibility across the team, and checking results on a regular schedule. If something is not working, adjust quickly instead of abandoning the effort, and keep a short log of what you changed and why. That record makes future decisions faster and helps new colleagues understand the reasoning behind your approach.

Frequently asked questions

Is a 10 always urgent?

Usually, but check whether the system is exposed.

What is EPSS?

A score estimating the likelihood of exploitation.

Final thoughts

CVSS is a starting point. Add context to decide what to fix first.