The Common Vulnerability Scoring System (CVSS) assigns a standardized severity score to a vulnerability. Scores run from 0 to 10, with higher numbers indicating greater severity. A CVSS score helps teams compare findings, but it is a starting point for risk assessment—not a measure of business risk on its own. section 10.2.1 section 6.3.2
The severity bands are:
- Low: 0.1–3.9; medium: 4.0–6.9. section 10.2.1
- High: 7.0–8.9; critical: 9.0–10.0. section 10.2.1
To decide what to fix first, consider the score alongside exploit likelihood, active threat intelligence, asset criticality, business impact, and compensating controls. EPSS estimates the probability of exploitation in the wild; CVSS does not provide that probability. A highly scored vulnerability behind strong controls may be less urgent than a moderately scored one on an exposed, mission-critical system. Internal assessments also matter because vulnerabilities in custom or niche systems may have no CVE entry. section 6.3.2 section 6.3.1
Prioritize the risk, not just the score
A dashboard reports 15 vulnerabilities, including two with high EPSS scores. One finding has a medium CVSS score but represents the highest risk and takes the least effort to mitigate. Addressing it first reduces overall risk exposure, leaving a medium residual risk. Report that decision with its risk and effort rationale rather than presenting the CVSS score alone. section 6.5
