# How to Read a CVSS Score (and When Not to Trust It)

> What CVSS base scores actually measure, how the 0–10 ranges map to severity labels, and why a 9.8 that nobody exploits can matter less than a 7.2 in the KEV.

- Published: 2026-08-05T00:00:00.000Z
- Tags: CVSS, Vulnerability Management
- Author: RuntimeRebel Editorial
- Canonical: https://runtimerebel.com/guides/how-to-read-a-cvss-score

Every vulnerability writeup throws a number at you: *CVSS 9.8, critical, patch
now.* The number is useful — but only if you know what it measures, and more
importantly what it does not.

## What the number actually measures

CVSS — the Common Vulnerability Scoring System — is a formula, not a
judgement. The **base score** (the one you almost always see quoted) combines
properties of the flaw itself: how it can be reached (network, adjacent,
local, physical), how much user interaction is required, whether privileges
are needed first, and what an attacker gets on success — impact to
confidentiality, integrity and availability.

The standard ranges are:

| Score | Label |
|---|---|
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |

A 9.8 typically means: reachable over the network, no authentication, no user
interaction, full impact. That is a real signal — it describes a flaw with no
structural obstacles between an attacker and your system.

## What the number does not measure

The base score says **nothing about whether anyone is actually exploiting the
flaw**, how widespread the affected product is, whether a public exploit
exists, or what the vulnerable component protects in *your* environment. It is
severity in a vacuum.

This matters because the volume of critical-scored CVEs is enormous, and most
are never exploited at all. If you patch strictly by base score, you will
spend real effort on theoretical risk while an actively exploited 7.2 waits
in the queue.

## The signals to combine with it

Three free signals turn a raw score into a decision:

- **Known exploitation.** CISA's [KEV catalog](/guides/cisa-kev-catalog-explained)
  lists only vulnerabilities confirmed exploited in the wild. Anything on it
  outranks a higher-scored CVE that is not. Our [CVE tracker](/cve) is built
  from this catalog.
- **Exploit prediction.** FIRST's EPSS estimates the probability a CVE will be
  exploited in the next 30 days. It is a model, not a fact — but a 90th-percentile
  EPSS score plus a high base score is a strong patch-first signal.
- **Your exposure.** A perfect 10 in software you do not run is a zero for
  you. Inventory beats arithmetic.

## How this site uses it

Articles here carry a five-level severity rating that deliberately does *not*
mirror raw CVSS: our calibration reserves the top ratings for cases with
evidence of real-world exploitation — the same logic as the KEV-first rule
above. The [severity ratings guide](/guides/how-we-rate-severity) explains the
exact rules.

## The one-line version

Read CVSS as "how bad could this be, structurally" — then let exploitation
evidence, not the score alone, decide what you patch today.

---

Curated evergreen guide, produced with AI assistance and maintained by the site (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/guides/how-to-read-a-cvss-score