Common Vulnerability Scoring System
Industry-standard 0-10 vulnerability severity scale; a high score alone does not mean active exploitation.
Two Check Point firewall flaws rated 9.8 out of 10 were listed as exploited by US authorities on 22 September 2026, with three days to patch: the latest top score to arrive with attacks already under way.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Is a CVSS 7.5 in active exploitation more dangerous than a 9.8 that is not?
Timeline for Common Vulnerability Scoring System
Mentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesMentioned in: N-able hardens N-central as attackers pivot
Cybersecurity: Threats and DefencesMentioned in: Magento RCE forces 9-day patch race
Cybersecurity: Threats and DefencesMentioned in: UAT-8616 keeps Cisco SD-WAN under fire
Cybersecurity: Threats and DefencesMentioned in: CISA deadline for PAN-OS RCE lands four days early
Cybersecurity: Threats and DefencesBackground
The Common Vulnerability Scoring System (CVSS) gives software flaws a severity score from 0.0 to 10.0. CISA, the UK's NCSC, the US National Vulnerability Database and software vendors all publish it. The current version, CVSS v4.0, was published in 2023 by FIRST, the Forum of Incident Response and Security Teams, and combines base, threat and environmental metrics; most vendor advisories publish only the base score.
Scores are set at disclosure, but the risk can change afterwards. F5 rated CVE-2025-53521 a moderate outage risk, then on 28 March 2026 reclassified it as a Remote Code Execution flaw scoring 9.8, the same day CISA listed it as exploited. Citrix scored CitrixBleed 3 (CVE-2026-3055) at 9.3 on disclosure on 23 March.
A high base score does not mean attackers are using a flaw, and a lower score does not mean it is SAFE. Defenders therefore weigh CVSS alongside exploitation data and CISA's known-exploited list. The scoring work itself is exposed to budget pressure: the US FY27 budget proposed on 7 April 2026 put NIST vulnerability-scoring programmes inside its cyber cuts.
Exploitation now sets the patch clock
Through 2026 the highest CVSS scores often arrived with attacks already running. On 14 May US authorities gave federal agencies three days to fix a maximum-severity flaw in Cisco's network-management software that a China-linked group was already exploiting. On 22 September two Check Point flaws rated 9.8 were listed as exploited, with a 25 September deadline.
The score itself did not set the timetable. When CISA listed a critical Palo Alto Networks firewall flaw on 6 May, its 9 May Deadline fell four days before the vendor's fix existed, so agencies could only apply a workaround. In each case confirmed exploitation, not the severity number, decided how fast defenders had to move.