CVSS

Almost every program contains bugs. Some are harmless, others allow outsiders to take over a device or steal data. Such dangerous bugs are called security vulnerabilities. Tens of thousands of them are publicly reported every year, and no one can fix them all at the same time. CVSS is a globally standardized scoring system that assigns each vulnerability a value between 0 and 10. This number expresses how severe the damage could be in the worst case.

Why a number decides on night shifts

A mid-sized company quickly ends up running several hundred programs and servers. If a scanner reports 400 open vulnerabilities one morning, the team needs a priority order. That order is exactly what the CVSS score provides. Vulnerabilities rated 9.0 or above are considered critical and are often closed the very same day, while a score of 3.1 may be allowed to wait for months.

The number also has a practical side effect: it makes discussions more objective. Without a shared measure, one vendor might claim their bug is insignificant while a security researcher raises the alarm. CVSS forces both to justify their assessment using the same criteria. Contracts and regulatory requirements also rely on it. Some oversight rules require, for example, that critical vulnerabilities be fixed within a fixed deadline.

That’s why the number almost always appears in news reports about cyberattacks. It is the quickest answer to the question of whether a report deserves panic or calm. A CVSS of 10.0 in widely used software is an event that even business news desks cover.

How individual characteristics turn into a score

CVSS doesn’t work on gut feeling but on a fixed list of characteristics. It asks, for example: Can the vulnerability be exploited over the internet, or only directly on the device? Does the attacker need a password? Does a user have to actively participate, for instance by clicking something? And what can the attacker ultimately achieve — only read data, or also alter data and take the system down?

Each of these questions is assigned a fixed numerical value. A formula combines them into what is called the base score. Think of it like a school grade made up of several partial scores, except the weighting is strictly prescribed. As a result, two experts assessing the same vulnerability usually arrive at the same number. Versions 3.1 and the newer version 4.0, which distinguishes characteristics more finely, are currently in use.

A common misconception: the CVSS score does not describe the actual risk. It only describes how severe the vulnerability is technically. Whether it actually becomes dangerous depends on how important the affected system is and whether attackers are already exploiting the vulnerability. A 9.8 on a test server without internet access is more harmless than a 6.5 in the customer database. That’s why companies combine the score with their own information.

Where the score shows up

Every publicly reported vulnerability receives an identification number starting with CVE — for example CVE-2021-44228, the famous Log4j vulnerability from 2021. In the databases that collect such reports, the CVSS score is listed right next to it. Log4j reached 10.0, the maximum score, and kept IT departments worldwide busy over Christmas.

Even without working in IT, people encounter the system indirectly. When a smartphone offers a security update, the accompanying text often lists the vulnerabilities fixed along with their ratings. Microsoft, Apple, Google, and SAP regularly publish such overviews, usually on fixed dates each month.

For investors, the number serves as an early warning signal. A critical vulnerability in a widely used product can trigger recalls, fines, and loss of trust. That’s why financial media report on especially high CVSS scores long before a concrete attack becomes known. At that point, the score is no longer just a technical detail but an indicator of possible costs.