You can now search across every topic, entity and event.What's new

Common Vulnerability Scoring System

Technology

Common Vulnerability Scoring System

Industry-standard 0-10 vulnerability severity scale; a high score alone does not mean active exploitation.

The Common Vulnerability Scoring System is the industry-standard 0-10 severity scale used by CISA, NCSC and NVD. A high score alone does not mean active exploitation: F5's CVE-2025-53521 sat at medium severity until reclassified to 9.8 on 28 March 2026, after exploitation was confirmed.

Last refreshed: 3 August 2026 · Appears in 1 active topic

Key Question

Is a CVSS 7.5 in active exploitation more dangerous than a 9.8 that is not?

Timeline for Common Vulnerability Scoring System

#6 3 Jun

Mentioned in: Magento RCE forces 9-day patch race

Cybersecurity: Threats and Defences

#4 14 May

Mentioned in: UAT-8616 keeps Cisco SD-WAN under fire

Cybersecurity: Threats and Defences

#3 6 May

Mentioned in: CISA deadline for PAN-OS RCE lands four days early

Cybersecurity: Threats and Defences

#1 7 Apr

Mentioned in: Trump proposes $707m CISA cut, 860 jobs

Cybersecurity: Threats and Defences

#1 28 Mar

Mentioned in: F5 reclassifies DoS bug to 9.8 RCE

Cybersecurity: Threats and Defences

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

The Common Vulnerability Scoring System (CVSS) is the standard framework CISA, NCSC, NVD and vendors use to assign numerical severity scores to software vulnerabilities, from 0.0 (none) to 10.0 (critical). The current version, CVSS v4.0, was published by FIRST, the Forum of Incident Response and Security Teams, in 2023, and comprises base, threat and environmental metrics; most vendor advisories publish only the base score.

The scheme has a structural weakness: scores are assigned at disclosure but exploitation can change the risk picture afterwards. CVE-2026-3055 (CitrixBleed 3) was scored 9.3 at disclosure, while F5's CVE-2025-53521 was rated medium severity before being reclassified to 9.8 once active exploitation was confirmed.

A high base score is not the same as active threat-actor prioritisation, and a lower one does not mean SAFE. The June 2026 KEV batch made the point starkly: a maximum-severity Magento flaw drew the loudest coverage and the tightest Deadline, while an older, lower-scored Oracle WebLogic bug was already delivering ransomware payloads via honeypot-observed traffic before it reached the list. Security teams that treat CVSS as their only triage signal are systematically under-weighting vulnerabilities whose exploitation class shifts after initial assessment.

Common Questions

What is the difference between CVSS v3.1 and CVSS v4.0?

CVSS v4.0, published by FIRST in 2023, replaced v3.1 with an expanded metric set covering base, threat and environmental scores. NVD now uses v4.0 as its primary scoring base. Vendor advisories often still publish only the base score, omitting the threat metrics that reflect real-world exploitation conditions.Source: FIRST

What is the CVSS score system and how does it work?

CVSS (Common Vulnerability Scoring System) is a standard framework for rating software vulnerability severity on a scale of 0 to 10. CVSS v4.0 is the current version, used by NIST's National Vulnerability Database and CISA to classify vulnerabilities for patch prioritisation.Source: FIRST / NIST

Can CVSS scores change after a vulnerability is disclosed?

Yes. Vendors can reclassify vulnerabilities after initial disclosure if exploitation evidence changes the assessed risk. F5's CVE-2025-53521 was reclassified from medium DoS to CVSS 9.8 RCE in March 2026 after active exploitation was confirmed.Source: F5 / CISA

Why do security teams not just patch the highest CVSS scores first?

CVSS scores are assigned at disclosure from theoretical analysis and can understate risk. A vendor may not know the true exploitation class until attackers demonstrate it, as happened with F5 CVE-2025-53521 (reclassified to 9.8 RCE months after a medium DoS initial rating). CISA KEV membership and active threat-feed data are required alongside CVSS to produce accurate prioritisation.Source: CISA / F5

Does a CVSS score of 10 mean a vulnerability is being actively exploited?

No. A CVSS score of 10.0 reflects worst-case theoretical severity, not confirmed attack activity. In June 2026, a 9.8-scored Magento flaw drew heavy attention while a lower-scored 7.5 Oracle WebLogic bug was already delivering ransomware payloads in the wild.Source: CISA / Sansec

How the World Sees Them

Reclassifying a DoS to an RCE after customer triage decisions have been made is an advisory credibility problem; vendors face pressure to confirm exploitation class before advisory publication rather than revising after damage is done.

CVSS base scores in NVD drive patch-prioritisation tooling across US federal and commercial environments; the score-versus-real-exploitation gap is a known structural weakness with no systematic fix in the current architecture.

Enterprise security teams

CVSS alone is insufficient for patch triage; integrating KEV membership, exploitation scan data and vendor reclassification history produces more accurate risk signals. The June 2026 WebLogic vs Magento prioritisation point is the clearest illustration to date.