WTF is a CVSS score?

Short version

CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you.

CVSS severity scale

The briefing

Who owns it

The Common Vulnerability Scoring System is owned and managed by FIRST, a US-based non-profit.

Version

Currently 4.0.

Base score

The number you usually see, written CVSS-B in version 4.0. It rates the flaw itself: can it be reached over the network, does the attacker need a login, what can they do once through.

Blind spots

The base score knows nothing about your setup or whether anyone is using the bug right now.

The rest is your job

CVSS has Threat and Environmental metrics to adjust for those things, but publishers typically give only the base score.

FIRST says it plainly

Base scores measure severity and should not be used alone to assess risk.

EPSS

Also from FIRST: an estimated probability that a CVE will be exploited in the wild in the next 30 days. A forecast, not a sighting.

In the Threat Brief this looks like:

Example only. The product, versions and names are made up.

What to do

• Treat the score as one input. CVSS tells you how bad.
• Check KEV to see if it is being used.
• Let your own exposure decide the rest. A high on your internet-facing login page, listed on KEV, is your morning.

Official sources

• FIRST: Common Vulnerability Scoring System
• FIRST: CVSS v4.0 Specification
• FIRST: CVSS v4.0 User Guide
• FIRST: Exploit Prediction Scoring System (EPSS)