CVE & CVSS Explained
CVE & CVSS, explained simply.
Every security alert quotes a CVE number and a CVSS score. Here is what they mean, and why a high score is not the whole story.
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a unique public ID for one specific security flaw, for example CVE-2026-110264. The format is the year the ID was assigned, followed by a sequence number.
IDs are issued by CVE Numbering Authorities (CNAs): software vendors, researchers and coordinators authorised by the CVE Program, which is run by MITRE with funding from the US government. A CVE ID tells everyone they are talking about the same bug. On its own, it says nothing about how dangerous the bug is.
Related terms you will see
- CWE (Common Weakness Enumeration): the type of mistake, such as CWE-79 (cross-site scripting) or CWE-416 (use-after-free).
- NVD (National Vulnerability Database): NIST’s database that adds analysis and scores to CVE records.
- KEV (Known Exploited Vulnerabilities): CISA’s catalogue of CVEs confirmed to be exploited in the wild.
- EPSS (Exploit Prediction Scoring System): a FIRST model estimating the probability a CVE will be exploited in the next 30 days.
What is CVSS?
The Common Vulnerability Scoring System, maintained by FIRST, rates the technical severity of a flaw from 0.0 to 10.0. The base score combines how easy the flaw is to exploit with how much damage a successful attack could do.
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
The eight base metrics (CVSS 3.1)
| Metric | Asks | Worst value |
|---|---|---|
| Attack Vector (AV) | From where can it be attacked? | Network: over the internet |
| Attack Complexity (AC) | Does the attacker need special conditions? | Low: works reliably |
| Privileges Required (PR) | Must the attacker already have an account? | None |
| User Interaction (UI) | Does a victim need to click or open something? | None |
| Scope (S) | Can the attack break out to other components? | Changed |
| Confidentiality (C) | Can data be stolen? | High |
| Integrity (I) | Can data or code be modified? | High |
| Availability (A) | Can the system be taken down? | High |
Try it yourself with our CVSS calculator.
Reading a vector string
Advisories often print the score as a vector string. Here is the one for GitLab’s CVE-2026-110264 from our Black October coverage:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H → 10.0 Critical
Read it left to right: reachable over the Network, Low complexity, No privileges, No user interaction, Scope Changed, and High impact on confidentiality, integrity and availability. In plain English: anyone on the internet can take full control, with no login and no victim action. That is as bad as it gets.
CVSS 3.1 vs CVSS 4.0
CVSS 4.0 was published by FIRST in November 2023 and is increasingly used in advisories (PHP’s 2026 advisories use it, for example). Key differences:
- A new Attack Requirements (AT) metric captures conditions outside the attacker’s control, such as a specific configuration.
- Scope is replaced by separate impact ratings for the vulnerable system and for subsequent systems.
- New supplemental metrics (such as Automatable and Recovery) add context without changing the score.
- Scores from the two versions are not directly comparable. Always note which version a score uses.
How to prioritise: severity is not risk
CVSS measures how bad a flaw could be. Your actual risk depends on whether you run the affected software, whether it is exposed, and whether attackers are using it. A practical order of work:
- Listed in CISA KEV and present on an internet-facing system: patch immediately.
- Critical or High, exposed to the internet, with a public exploit or high EPSS: patch within days.
- Critical or High on internal systems: schedule promptly and add compensating controls.
- Medium and Low: handle in your regular patch cycle.
MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.