CVSS (Common Vulnerability Scoring System)

CVSS is the most widely used vulnerability scoring standard, maintained by FIRST.org. Its base score combines exploitability metrics (attack vector, complexity, privileges, user interaction) with impact metrics (confidentiality, integrity, availability).

Its limitation for prioritisation is well documented: roughly 60 percent of all CVEs score 7.0 or above, so a CVSS-only queue tells you almost everything is critical. It cannot tell you what attackers are actually exploiting.

CVSS scores a vulnerability from zero to ten across several metric groups. The base metrics capture the intrinsic characteristics of a flaw, such as how it is accessed, how complex exploitation is, and its impact on confidentiality, integrity and availability. Optional temporal and environmental metrics adjust the score for the maturity of available exploits and the specifics of a particular deployment.

The score maps to severity bands, from low through medium, high and critical. This gives a consistent, vendor-neutral way to communicate how serious a vulnerability is, which is why CVSS appears in the National Vulnerability Database, most scanning tools and many compliance frameworks. A shared severity language lets defenders, vendors and auditors refer to the same measure.

CVSS has a well-known limitation that shapes how it should be used. It measures potential impact, not the likelihood of exploitation, and in practice a large share of all CVEs score high or critical. A queue ordered by CVSS alone therefore flags almost everything as urgent, which provides little help in deciding what to fix first.

The practical answer is to treat CVSS as one dimension of risk rather than the whole picture. Combined with exploitation-likelihood signals such as EPSS and confirmed-exploitation data such as CISA KEV, CVSS severity becomes genuinely useful: it tells a team how damaging a vulnerability would be, while the other signals tell them how likely it is to be attacked. Together they produce prioritisation that reflects real-world risk.

CVSS has evolved through several versions, with version 3.1 in widespread use and version 4.0 introduced to address limitations of its predecessors, including a finer treatment of impact and exploitability. Understanding which version a score refers to matters, because the same vulnerability can receive somewhat different numbers under different versions, and tools and databases may not all use the latest revision.

The most common misuse of CVSS is treating the base score as a complete measure of risk and remediating strictly in its order. Because so many vulnerabilities score high or critical, this produces an unworkable queue. Used correctly, CVSS answers only how damaging a vulnerability would be if exploited, and it should be combined with exploitation-likelihood signals to decide what to actually fix first, rather than driving prioritisation on its own.

Precursor uses CVSS as one input (counting only the severity above 7) alongside EPSS likelihood, CISA KEV, CWE impact and threat-actor attribution, so severity informs the decision without dominating it.