A CVSS score is one of the first things you see on any vulnerability report, and one of the most misused. Here's what actually goes into that number, and why it shouldn't be the only thing driving your patch priority.
What CVSS actually measures
The Common Vulnerability Scoring System produces a 0–10 score from several metric groups:
- Attack Vector — can it be exploited over the network, or does it require local access?
- Attack Complexity — does exploitation require special conditions?
- Privileges Required — does the attacker need to already be authenticated?
- User Interaction — does a victim need to click something?
- Scope, Confidentiality, Integrity, Availability impact
These combine into a base score that describes the vulnerability in isolation — not in your specific system.
Why context changes everything
A remote code execution bug scores high regardless of where it lives. But if that vulnerable service sits behind a VPN with no internet exposure, your real-world risk is very different from a public API with the same CVE. This is why vulnerability management frameworks increasingly separate "base severity" from "environmental risk."
Base score vs. temporal and environmental scores
CVSS actually supports three score types, though most tools only surface the base score:
- Base — intrinsic severity, doesn't change over time
- Temporal — adjusts for exploit maturity and available fixes
- Environmental — adjusts for your specific deployment
Most teams never see anything but the base score, which is why relying on CVSS alone leads to either patch fatigue (fixing everything scored 7+) or missed risk (ignoring a 5.5 that's trivially exploitable in your specific setup).
A practical triage approach
- Filter by CVSS as a first pass.
- Cross-reference with exploit availability (is it in CISA's Known Exploited Vulnerabilities catalog?).
- Check actual exposure — is the affected asset internet-facing, and does it handle sensitive data?
- Prioritize based on the combination, not the CVSS number alone.
CVSS is a useful common language for describing severity — it was never meant to be a prioritization queue on its own.