CVSS Score

Almost every program contains bugs. Some of them can be exploited by an attacker to gain access to other people’s data or to remotely control a computer. Such bugs are called security vulnerabilities. So that everyone involved can talk about their severity in the same way, there is a uniform rating scale: the CVSS score. It ranges from 0.0 to 10.0, with 10.0 being the worst case. The abbreviation stands for Common Vulnerability Scoring System, roughly meaning a “shared system for rating vulnerabilities.”

Why a 9.8 ruins your evening off

A large company often operates thousands of servers and programs. New vulnerabilities become known every week, sometimes hundreds of them. No one can fix everything at once. The score helps sort through this flood. Anything from 9.0 upward is considered critical and is usually dealt with immediately, if necessary at night or on weekends.

The number also has legal and contractual consequences. Many contracts between companies and their IT service providers specify deadlines that are directly tied to the score. A critical vulnerability must then be closed within, say, 24 hours, a medium one within 30 days. Authorities and insurers also rely on the scale because it is vendor-independent.

A common misconception is that a high score automatically means real danger. The value only describes the theoretical potential for harm. If the affected software isn’t even running on your system, or the server is cut off from the internet anyway, the vulnerability is practically harmless. That’s why experts always supplement the score by looking at their own environment.

What the number is made up of

The score doesn’t come out of nowhere; it’s calculated according to fixed rules. To do this, a series of questions about the vulnerability are answered. Can the attacker exploit it over the internet, or does he have to sit in the same room at the device? Does he need a valid password? Does a user have to help, for instance by clicking a link? The easier the attack, the higher the value.

Then there’s the question of the damage. Three things are assessed separately: whether data can be read, whether it can be altered, and whether the service can be brought down. A vulnerability that fully affects all three areas and, on top of that, works from the network without a password, ends up at 10.0. A fixed formula turns all these answers into a single number.

You can think of it like the efficiency of a burglary. An unlocked patio door in an empty garden shed is something different from an open vault door at a bank. Both are security flaws, but the potential damage differs greatly. In addition to the base score, there are optional supplementary scores, for example whether ready-made attack code is already circulating. In practice, however, these are maintained less often.

Where you’ll encounter the number in news and software

Every publicly known vulnerability gets an identifier that begins with “CVE”, for example CVE-2021-44228. The accompanying report almost always includes the CVSS score as well. Security advisories from Microsoft, Apple, or Linux vendors list it, just as the warnings from Germany’s Federal Office for Information Security (BSI) do.

The number also shows up in the business press. When the “Log4Shell” vulnerability in a widely used Java library became known at the end of 2021, the score was 10.0. That number appeared in almost every headline, because it conveyed the severity of the situation in a single figure. For investors, it’s a rough signal of how costly a security incident could become for a company.

Even as a private individual, you benefit from it indirectly. When your phone or your browser reports an urgent update, there’s often a highly rated vulnerability behind it. Development tools automatically check whether a project contains vulnerable components and display their score. Anyone who deals with IT professionally therefore encounters the scale almost every day.