{"id":3387,"date":"2026-10-27T10:20:00","date_gmt":"2026-10-27T17:20:00","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/cve-cvss\/"},"modified":"2026-10-27T10:20:00","modified_gmt":"2026-10-27T17:20:00","slug":"cve-cvss","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/cve-cvss\/","title":{"rendered":"Explication des syst\u00e8mes CVE et CVSS"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-cve-cvss\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Learn<\/div><h2>CVE &amp; CVSS, <span>explained simply.<\/span><\/h2><p>Every security alert quotes a CVE number and a CVSS score. Here is what they mean, and why a high score is not the whole story.<\/p><div class=\"toc\"><a href=\"#cve\">What is a CVE?<\/a><a href=\"#cvss\">What is CVSS?<\/a><a href=\"#vector\">Reading a vector<\/a><a href=\"#v4\">CVSS 3.1 vs 4.0<\/a><a href=\"#prioritise\">How to prioritise<\/a><\/div><\/section>\n<section class=\"sec\" id=\"cve\"><h3>What is a CVE?<\/h3>\n<p>A <b>CVE<\/b> (Common Vulnerabilities and Exposures) is a unique public ID for one specific security flaw, for example <code>CVE-2026-110264<\/code>. The format is the year the ID was assigned, followed by a sequence number.<\/p>\n<p>IDs are issued by <b>CVE Numbering Authorities (CNAs)<\/b>: software vendors, researchers and coordinators authorised by the CVE Program, which is run by MITRE with funding from the US government. A CVE ID tells everyone they are talking about the same bug. On its own, it says nothing about how dangerous the bug is.<\/p>\n<h4>Related terms you will see<\/h4>\n<ul class=\"l\">\n<li><b>CWE<\/b> (Common Weakness Enumeration): the <i>type<\/i> of mistake, such as CWE-79 (cross-site scripting) or CWE-416 (use-after-free).<\/li>\n<li><b>NVD<\/b> (National Vulnerability Database): NIST&#8217;s database that adds analysis and scores to CVE records.<\/li>\n<li><b>KEV<\/b> (Known Exploited Vulnerabilities): CISA&#8217;s catalogue of CVEs <i>confirmed<\/i> to be exploited in the wild.<\/li>\n<li><b>EPSS<\/b> (Exploit Prediction Scoring System): a FIRST model estimating the probability a CVE will be exploited in the next 30 days.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"cvss\"><h3>What is CVSS?<\/h3>\n<p>The <b>Common Vulnerability Scoring System<\/b>, maintained by FIRST, rates the <i>technical severity<\/i> of a flaw from 0.0 to 10.0. The base score combines how easy the flaw is to exploit with how much damage a successful attack could do.<\/p>\n<table><tr><th>Score<\/th><th>Severity<\/th><\/tr>\n<tr><td>0.0<\/td><td><span class=\"pill p-n\">None<\/span><\/td><\/tr>\n<tr><td>0.1 \u2013 3.9<\/td><td><span class=\"pill p-l\">Low<\/span><\/td><\/tr>\n<tr><td>4.0 \u2013 6.9<\/td><td><span class=\"pill p-m\">Medium<\/span><\/td><\/tr>\n<tr><td>7.0 \u2013 8.9<\/td><td><span class=\"pill p-h\">High<\/span><\/td><\/tr>\n<tr><td>9.0 \u2013 10.0<\/td><td><span class=\"pill p-c\">Critical<\/span><\/td><\/tr><\/table>\n<h4>The eight base metrics (CVSS 3.1)<\/h4>\n<table><tr><th>Metric<\/th><th>Asks<\/th><th>Worst value<\/th><\/tr>\n<tr><td>Attack Vector (AV)<\/td><td>From where can it be attacked?<\/td><td>Network: over the internet<\/td><\/tr>\n<tr><td>Attack Complexity (AC)<\/td><td>Does the attacker need special conditions?<\/td><td>Low: works reliably<\/td><\/tr>\n<tr><td>Privileges Required (PR)<\/td><td>Must the attacker already have an account?<\/td><td>None<\/td><\/tr>\n<tr><td>User Interaction (UI)<\/td><td>Does a victim need to click or open something?<\/td><td>None<\/td><\/tr>\n<tr><td>Scope (S)<\/td><td>Can the attack break out to other components?<\/td><td>Changed<\/td><\/tr>\n<tr><td>Confidentiality (C)<\/td><td>Can data be stolen?<\/td><td>High<\/td><\/tr>\n<tr><td>Integrity (I)<\/td><td>Can data or code be modified?<\/td><td>High<\/td><\/tr>\n<tr><td>Availability (A)<\/td><td>Can the system be taken down?<\/td><td>High<\/td><\/tr><\/table>\n<p class=\"small\">Try it yourself with our <a href=\"\/tools\/cvss-calculator\/\">CVSS calculator<\/a>.<\/p><\/section>\n\n<section class=\"sec\" id=\"vector\"><h3>Reading a vector string<\/h3>\n<p>Advisories often print the score as a <b>vector string<\/b>. Here is the one for GitLab&#8217;s CVE-2026-110264 from our Black October coverage:<\/p>\n<pre>CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H   \u2192  10.0 Critical<\/pre>\n<p>Read it left to right: reachable over the <b>N<\/b>etwork, <b>L<\/b>ow complexity, <b>N<\/b>o privileges, <b>N<\/b>o user interaction, Scope <b>C<\/b>hanged, and <b>H<\/b>igh impact on confidentiality, integrity and availability. In plain English: anyone on the internet can take full control, with no login and no victim action. That is as bad as it gets.<\/p><\/section>\n\n<section class=\"sec\" id=\"v4\"><h3>CVSS 3.1 vs CVSS 4.0<\/h3>\n<p>CVSS 4.0 was published by FIRST in November 2023 and is increasingly used in advisories (PHP&#8217;s 2026 advisories use it, for example). Key differences:<\/p>\n<ul class=\"l\">\n<li>A new <b>Attack Requirements (AT)<\/b> metric captures conditions outside the attacker&#8217;s control, such as a specific configuration.<\/li>\n<li><b>Scope<\/b> is replaced by separate impact ratings for the vulnerable system and for <b>subsequent systems<\/b>.<\/li>\n<li>New <b>supplemental<\/b> metrics (such as Automatable and Recovery) add context without changing the score.<\/li>\n<li>Scores from the two versions are <b>not directly comparable<\/b>. Always note which version a score uses.<\/li>\n<\/ul><\/section>\n\n<section class=\"sec\" id=\"prioritise\"><h3>How to prioritise: severity is not risk<\/h3>\n<p>CVSS measures how bad a flaw <i>could<\/i> be. Your actual risk depends on whether you run the affected software, whether it is exposed, and whether attackers are using it. A practical order of work:<\/p>\n<ol class=\"l\">\n<li><b>Listed in CISA KEV<\/b> and present on an internet-facing system: patch immediately.<\/li>\n<li><b>Critical or High<\/b>, exposed to the internet, with a public exploit or high EPSS: patch within days.<\/li>\n<li><b>Critical or High<\/b> on internal systems: schedule promptly and add compensating controls.<\/li>\n<li><b>Medium and Low<\/b>: handle in your regular patch cycle.<\/li>\n<\/ol>\n<div class=\"callout\"><b>Remember:<\/b> a patch is only done when it is verified. Distribution backports can keep the old version number, so confirm fixes using the vendor advisory or package changelog, not the version banner.<\/div><\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, plus security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>What CVE IDs and CVSS scores mean, and how to prioritise patches.<\/p>","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3387","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3387"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3387\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}