CVSS (Common Vulnerability Scoring System)
CVSS is an open framework for communicating the severity of software vulnerabilities. A CVSS v3 base score from 0 to 10 reflects factors like attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. Scores ≥ 9.0 are Critical; ≥ 7.0 are High.
A CVSS base score is computed from the vulnerability alone. Can it be reached over the network? Does it need privileges or a user’s click? Does it break confidentiality, integrity, availability, and how completely? The metrics are combined into a number from 0 to 10 and a label: Low, Medium, High, Critical.
The score is deliberately blind to context. It does not know whether anyone is exploiting the bug, whether an exploit exists, or whether the affected component is exposed in your environment. That is a feature for a shared standard and a trap for prioritisation: a large share of published CVEs are High or Critical, and a team that patches by CVSS alone is patching by volume.
CVSS, EPSS and KEV answer three different questions. CVSS asks how bad the vulnerability would be if exploited, and gives a severity from 0 to 10 that never changes once published. EPSS asks how likely it is to be exploited in the next 30 days, and gives a probability that is recomputed daily as exploitation evidence arrives. KEV asks whether it is already being exploited, and gives a yes or no from CISA. A CVSS 9.8 with an EPSS of 0.4 % and no KEV entry is a theoretical emergency; a CVSS 6.5 in the KEV catalog is a practical one. Prioritisation that uses only the first number patches the wrong things first.
Example
A CVE is published at CVSS 9.8: network-reachable, no privileges, no user interaction, total impact. Six months later its EPSS is 0.6 % and it is not in KEV. The score was accurate about severity and said nothing about urgency.
In isMalicious
Every CVE page on isMalicious shows the CVSS vector and score alongside EPSS and KEV status, and CVE Watch findings carry all three so the environment’s exposure can be sorted by likelihood rather than by severity alone.
Frequently Asked Questions
What is CVSS (Common Vulnerability Scoring System)?
CVSS is an open framework for communicating the severity of software vulnerabilities. A CVSS v3 base score from 0 to 10 reflects factors like attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. Scores ≥ 9.0 are Critical; ≥ 7.0 are High.
How is CVSS (Common Vulnerability Scoring System) related to CVE (Common Vulnerabilities and Exposures)?
CVSS (Common Vulnerability Scoring System) and CVE (Common Vulnerabilities and Exposures) are both key concepts in threat intelligence. CVE is a public catalogue of known cybersecurity vulnerabilities, maintained by MITRE and sponsored by CISA. Each entry has a unique CVE ID (e.g., CVE-2024-12345), a description, and references. CVE IDs are the universal language for tracking and patching specific vulnerabilities.
Related Terms
CVE (Common Vulnerabilities and Exposures)
CVE is a public catalogue of known cybersecurity vulnerabilities, maintained by MITRE and sponsored by CISA. Each entry has a unique CVE ID (e.g., CVE-2024-12345), a description, and references. CVE IDs are the universal language for tracking and patching specific vulnerabilities.
EPSS (Exploit Prediction Scoring System)
EPSS is a data-driven model from FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Scores range from 0 to 1 (0%–100%). EPSS helps prioritize patching by combining NVD data with real-world exploitation observations.
KEV (CISA Known Exploited Vulnerabilities)
The CISA KEV catalog lists CVEs that have been confirmed as actively exploited in the wild. US federal agencies are required to patch KEV vulnerabilities by mandated due dates. KEV status is the highest-urgency signal for vulnerability prioritization.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.