How to Read a CVSS Score (and When Not to Trust It)
What CVSS base scores actually measure, how the 0–10 ranges map to severity labels, and why a 9.8 that nobody exploits can matter less than a 7.2 in the KEV.
Guides are curated reference content: drafted with AI assistance, grounded in this site's own data, and maintained over time — unlike the automated news coverage. Editorial policy
Every vulnerability writeup throws a number at you: CVSS 9.8, critical, patch now. The number is useful — but only if you know what it measures, and more importantly what it does not.
What the number actually measures
CVSS — the Common Vulnerability Scoring System — is a formula, not a judgement. The base score (the one you almost always see quoted) combines properties of the flaw itself: how it can be reached (network, adjacent, local, physical), how much user interaction is required, whether privileges are needed first, and what an attacker gets on success — impact to confidentiality, integrity and availability.
The standard ranges are:
| Score | Label |
|---|---|
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
A 9.8 typically means: reachable over the network, no authentication, no user interaction, full impact. That is a real signal — it describes a flaw with no structural obstacles between an attacker and your system.
What the number does not measure
The base score says nothing about whether anyone is actually exploiting the flaw, how widespread the affected product is, whether a public exploit exists, or what the vulnerable component protects in your environment. It is severity in a vacuum.
This matters because the volume of critical-scored CVEs is enormous, and most are never exploited at all. If you patch strictly by base score, you will spend real effort on theoretical risk while an actively exploited 7.2 waits in the queue.
The signals to combine with it
Three free signals turn a raw score into a decision:
- Known exploitation. CISA’s KEV catalog lists only vulnerabilities confirmed exploited in the wild. Anything on it outranks a higher-scored CVE that is not. Our CVE tracker is built from this catalog.
- Exploit prediction. FIRST’s EPSS estimates the probability a CVE will be exploited in the next 30 days. It is a model, not a fact — but a 90th-percentile EPSS score plus a high base score is a strong patch-first signal.
- Your exposure. A perfect 10 in software you do not run is a zero for you. Inventory beats arithmetic.
How this site uses it
Articles here carry a five-level severity rating that deliberately does not mirror raw CVSS: our calibration reserves the top ratings for cases with evidence of real-world exploitation — the same logic as the KEV-first rule above. The severity ratings guide explains the exact rules.
The one-line version
Read CVSS as “how bad could this be, structurally” — then let exploitation evidence, not the score alone, decide what you patch today.