What does a CVSS score mean?
Short answer
CVSS (Common Vulnerability Scoring System) rates the technical severity of a vulnerability from 0 to 10, based on factors such as how it is exploited and its impact. It measures severity, not risk: a high score does not mean the flaw is being exploited or that it matters in your environment.
The details
Combine CVSS with exploitation evidence (CISA KEV), exploitation likelihood (EPSS) and your own context, such as whether the system is internet-facing, to decide what to patch first.
Useful next reads and tools
Terms explained
- CVSS
- CVSS is a standard maintained by FIRST for rating the technical severity of a vulnerability on a scale from 0 to 10.
- EPSS
- EPSS, maintained by FIRST, estimates the probability that a published vulnerability will be exploited in the wild within the next 30 days.
- Known Exploited Vulnerabilities (KEV)
- CISA’s Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities with reliable evidence that attackers are exploiting them.
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more