CVSS Common Vulnerability Scoring System
The 0-10 severity scale assigned to each CVE. CVSS measures impact in isolation; real-world risk requires combining it with EPSS and asset context.
CVSS expresses vulnerability severity on a scale from 0 to 10, banded as None, Low, Medium, High and Critical. The score most people quote is the Base score, which is built from characteristics intrinsic to the vulnerability: how it can be reached, how hard exploitation is, what privileges and user interaction it requires, and what it does to confidentiality, integrity and availability.
The standard has more to it than the number vendors publish. Alongside Base metrics, CVSS defines Threat metrics, which adjust for what is known about exploitation in the wild, and Environmental metrics, which let you re-score a vulnerability for your own deployment. Almost nobody applies the latter two, which is why a raw Base score both overstates risk on well-isolated systems and understates it on crown-jewel ones.
A base score also says nothing about likelihood. It is deliberately a measure of impact if exploited, not a prediction that exploitation will occur, which is the gap EPSS was created to fill. The defensible way to prioritize is to read CVSS as the consequence, EPSS as the probability, and asset criticality as the multiplier on both.
Common questions
What does CVSS stand for?
CVSS stands for the Common Vulnerability Scoring System. It is an open standard, governed by FIRST, for rating the severity of software vulnerabilities on a 0 to 10 scale so that different organizations describe the same flaw in comparable terms.
What is considered a high CVSS score?
The standard bands are 0.0 None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, and 9.0 to 10.0 Critical. In practice many organizations set remediation deadlines against these bands, which works only when the score is read together with whether the asset is exposed and whether anyone is exploiting the flaw.
Why is CVSS not enough on its own?
Because it scores impact in isolation and is usually consumed as a Base score that ignores both your environment and the real world. It cannot tell you whether a vulnerability is being exploited, whether the affected system is reachable from the internet, or whether it holds anything worth taking. Pairing it with EPSS for likelihood and with asset context for consequence is what makes it actionable.
CVSS is one signal.
We watch the rest.
Vijilan runs a 24/7 SOC across endpoint, identity, cloud, network, SaaS and mobile, and acts on what it finds rather than forwarding an alert.