Common Vulnerability Scoring System

The Common Vulnerability Scoring System (CVSS) is the standard framework used by CISA, NCSC, NVD and vendors to assign numerical severity scores to software vulnerabilities. CVE-2026-3055 (CitrixBleed 3) was scored CVSS v4.0 9.3 at disclosure, while CVE-2025-53521 in F5 BIG-IP APM was initially rated medium severity and reclassified to CVSS v3.1 9.8 after active exploitation was confirmed. The reclassification pattern reveals a structural weakness: CVSS scores are assigned from analysis at disclosure, but exploitation patterns can change the operational risk profile after release.

CVSS v4.0, the current version, was published by FIRST (Forum of Incident Response and Security Teams) in 2023. It replaced v3.1 as the primary scoring base for NVD enrichment in the US government's vulnerability management ecosystem. The score comprises base, threat and environmental metrics; vendor advisories typically publish only the base score, while CISA's KEV additions reflect a threat-metric assessment of active exploitation.

For enterprise patch prioritisation, CVSS scores are an input but not a complete picture. The F5 case in this update illustrates why: a DoS bug initially scored medium was in production exploitation as an RCE before the reclassification arrived. Security teams using CVSS as their only triage signal are systematically under-weighting vulnerabilities whose exploitation class changes after initial assessment.