--- title: What is CVSS description: Learn about Open Source Compliance, license management, and open source security. Protect your IP and secure your software. url: "https://xygeni.io/sscs-glossary/what-is-cvss/" updated: "2025-09-10" category: Vulnerability Management --- # What is CVSS ## **Introduction to CVSS** The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing and scoring the severity of software vulnerabilities. CVSS assigns a numerical score between 0.0 and 10.0, where higher scores indicate more critical vulnerabilities. By understanding *what is CVSS*, organizations can prioritize their remediation efforts effectively. Furthermore, the Common Vulnerability Scoring System provides a consistent risk assessment method. As a result, security teams can focus on the most critical threats, improving overall security posture. Definition: ## **What is CVSS?** The Common Vulnerability Scoring System, developed by the Forum of Incident Response and Security Teams (FIRST), offers a systematic way to measure vulnerability severity. In fact, CVSS provides a universal scoring mechanism that is widely used in cybersecurity and application security (AppSec). Moreover, knowing what is CVSS helps security teams standardize risk assessment. Therefore, all stakeholders can understand the severity and impact of vulnerabilities. Consequently, integrating the Common Vulnerability Scoring System into security practices enhances clarity and efficiency ## **How the Common Vulnerability Scoring System Works** The **CVSS** evaluates vulnerabilities using three primary metric groups. Specifically, these groups are: ###### **1. Base Metrics** These represent the fundamental properties of a vulnerability. Specifically, CVSS they include: - **Attack Vector (AV)** – How the vulnerability can be exploited (e.g., network, local). - **Attack Complexity (AC)** – The difficulty level of exploitation. - **Privileges Required (PR)** – The access level needed for exploitation. - **User Interaction (UI)** – Whether user action is necessary. - **Impact Metrics** – The effect on **Confidentiality (C)**, **Integrity (I)**, and **Availability (A)**. ###### **2. Temporal Metrics** These reflect factors that change over time. For example: - **Exploit Code Maturity** – Availability of exploit code. - **Remediation Level** – Whether patches or mitigations are available. - **Report Confidence** – Reliability of the vulnerability report. ###### **3. Environmental Metrics** These metrics adapt the Base Score to an organization’s specific environment. **For instance**: - **Security Requirements** – Importance of confidentiality, integrity, and availability. - **Modified Base Metrics** – Adjustments reflecting organizational context. ## **Why the CVSS is Important** Understanding *what is CVSS* is essential for **CISOs, CIOs**, and security professionals. Specifically, Common Vulnerability Scoring System helps because it: - **Prioritizes Vulnerabilities**: Above all, it ensures that the most critical issues are addressed first. - **Standardizes Communication**: **In other words**, the **Common Vulnerability Scoring System** provides a universal language for discussing vulnerability severity. - **Supports Compliance**: Moreover, many regulations mandate using **CVSS** for risk management. - **Improves Efficiency**: Consequently, by using it, security teams can streamline the vulnerability management process. Therefore, integrating CVSS helps organizations manage risk more effectively and allocate resources wisely. ## **CVSS Score Ranges** **CVSS** scores fall into four categories: - **Low:** 0.1 - 3.9 - **Medium:** 4.0 - 6.9 - **High:** 7.0 - 8.9 - **Critical:** 9.0 - 10.0 **Thus**, knowing *what is CVSS* and these score ranges helps teams prioritize vulnerabilities accurately. ## **Challenges with Common Vulnerability Scoring System** - **Lack of Context**: For instance, CVSS scores don’t always reflect specific business impacts. - **Static Base Scores**: In addition, scores may not adapt as [**threats evolve.**](https://xygeni.io/blog/cvss-a-risk-score-framework-to-prioritize-threats/) - **Alert Fatigue**: On the other hand, too many high-severity alerts can overwhelm teams. **To overcome these challenges**, combining **CVSS** with real-time threat intelligence is essential. Watch our talk on [**Endless Vulnerabilities, Smarter Defenses on YouTube.**](https://www.youtube.com/watch?v=n0IrY_PpKN8&list=PLI93m4TILMD52285iOr5JGnbu70GPed2U&index=14) ## **How Xygeni Enhances CVSS-Based Vulnerability Management** Xygeni’s **Software Composition Analysis (SCA)** solution, part of the **Open Source Security** offering, leverages the **Common Vulnerability Scoring System**. **Moreover**, understanding *what is CVSS* helps organizations detect, prioritize, and remediate vulnerabilities in open-source dependencies​. ### **Xygeni’s SCA Solution Enhancements** - **Dynamic Risk Assessment**: Integrates with real-time threat intelligence. - **Noise Reduction**: **In particular**, filters false positives to highlight real threats​. - **Seamless Integration**: Furthermore, embeds vulnerability detection into CI/CD pipelines​. **In summary**, by knowing *what is CVSS* and leveraging Xygeni’s SCA solution, organizations can significantly improve their vulnerability management processes. ## **Protect Your Open Source Dependencies with Xygeni** Leverage the **Common Vulnerability Scoring System** to stay ahead of vulnerabilities. [**Request a Demo Today!**](https://xygeni.io/book-a-demo/)Discover how Xygeni’s SCA solution enhances your vulnerability management. [![cvss-what-is-cvss-common-vulnerability-scoring-system](https://xygeni.io/wp-content/uploads/2024/12/PDF-Resource-3-1.jpg)](https://xygeni.io/download-ebook-advanced-software-composition-analysis/) ## **Some FAQs About CVSS** **What is CVSS in cybersecurity?** The Common Vulnerability Scoring System, is a standardized method used to rate the severity of software vulnerabilities. It helps organizations prioritize remediation efforts. **What does a CVSS score of 9.8 mean?** A score of 9.8 falls in the **Critical** range (9.0–10.0), indicating a severe vulnerability that should be addressed immediately. **Who developed the Common Vulnerability Scoring System?** It was developed by the **Forum of Incident Response and Security Teams (FIRST)**.