Common Vulnerability Scoring System
| Common Vulnerability Scoring System | |
|---|---|
 | |
| Abbreviation | CVSS |
| Status | Active |
| First published | February 2005 |
| Latest version | 4.0 |
| Organization | Forum of Incident Response and Security Teams |
| Domain | Information security |
| Website | www |
The Common Vulnerability Scoring System (CVSS) is a framework for rating the severity of computer system vulnerabilities. Scores are calculated from metrics that approximate the ease and impact of exploits. Scores range from 0 (minor) to 10 (severe). While many use only the CVSS Base score for determining severity, temporal and environmental scores also exist, to account for the availability of mitigations and the number of vulnerable systems within an organization, respectively.
The current version of CVSS (CVSSv4.0) was released in November 2023.
CVSS is not intended as a method for patch prioritization, but is often used as one regardless. A more effective approach is to integrate CVSS with predictive models like the Exploit Prediction Scoring System (EPSS), to prioritize remediation based on the likelihood of real-world exploitation.