Updated 1 Nov 2026 · 6 min read
On this page
After this page you will be able to read a CVSS vector string, name every CVSS v3.1 base metric and its values, map a score to its severity rating, calculate a simple v3.1 base score by hand, and explain what the Forum of Incident Response and Security Teams (FIRST) changed in CVSS v4.0. Everything here follows the FIRST specification documents for each version.
The metric groups
The Common Vulnerability Scoring System (CVSS) captures the principal technical characteristics of software, hardware and firmware vulnerabilities, and produces numerical scores indicating severity relative to other vulnerabilities. CVSS v3.1 has three metric groups:
- Base: the intrinsic characteristics of a vulnerability that are constant over time and across user environments. It is split into Exploitability metrics and Impact metrics.
- Temporal: characteristics that may change over time but not across environments. Its metrics are Exploit Code Maturity (E), Remediation Level (RL) and Report Confidence (RC).
- Environmental: characteristics unique to your environment. It holds the Security Requirements (CR, IR, AR) and Modified Base metrics that let an analyst override base values for their own setting.
The base equation produces a score from 0.0 to 10.0. The v3.1 specification says Base and Temporal metrics are generally specified by vulnerability bulletin analysts, security product vendors or application vendors, while Environmental metrics are specified by end-user organisations. Scoring Temporal and Environmental metrics is not required, but the specification recommends it.
CVSS v3.1 base metrics and values
| Metric | Values | What it asks |
|---|---|---|
| Attack Vector (AV) | Network (N), Adjacent (A), Local (L), Physical (P) | How remote can the attacker be? |
| Attack Complexity (AC) | Low (L), High (H) | Must conditions beyond the attacker's control exist? |
| Privileges Required (PR) | None (N), Low (L), High (H) | What privileges does the attacker need first? |
| User Interaction (UI) | None (N), Required (R) | Must a user other than the attacker take part? |
| Scope (S) | Unchanged (U), Changed (C) | Can the exploit affect resources beyond the vulnerable component's security scope? |
| Confidentiality (C), Integrity (I), Availability (A) | High (H), Low (L), None (N) | How much of each is lost? |
For each exploitability metric, the base score is greatest for the most remote, least complex attack that needs no privileges and no user interaction. The base score is also greatest when a scope change occurs. The specification also says all metrics should be scored assuming the attacker has already located and identified the vulnerability.
Qualitative severity ratings
| Rating | CVSS score |
|---|---|
| None | 0.0 |
| Low | 0.1 to 3.9 |
| Medium | 4.0 to 6.9 |
| High | 7.0 to 8.9 |
| Critical | 9.0 to 10.0 |
The same five bands appear in both the v3.1 and v4.0 specifications. Both say the use of these ratings is optional and that there is no requirement to include them when publishing CVSS scores.
Reading a vector string
A vector string records the metric values behind a score. A v3.1 vector begins with CVSS:3.1, then each metric follows a forward slash as an abbreviated name, a colon and an abbreviated value. The specification's own example is:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Read left to right, that is Network attack vector, Low complexity, High privileges required, no user interaction, Scope Unchanged, Low confidentiality and integrity impact, and no availability impact. All base metrics must be present. Temporal and Environmental metrics are optional, and any omitted are treated as Not Defined (X). In v3.1 a preferred order exists but other orderings are valid, and the specification says programs reading v3.1 vectors must accept metrics in any order.
A worked v3.1 base score
Take CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The v3.1 specification gives these constants: AV Network 0.85, AC Low 0.77, PR None 0.85, UI None 0.85, and High impact 0.56.
- Impact Sub-Score (ISS) = 1 minus (1 minus 0.56) x (1 minus 0.56) x (1 minus 0.56) = 1 minus 0.085184 = 0.914816.
- Scope is Unchanged, so Impact = 6.42 x ISS = 5.8731.
- Exploitability = 8.22 x 0.85 x 0.77 x 0.85 x 0.85 = 3.8870.
- Base score = Roundup(Minimum(Impact + Exploitability, 10)) = Roundup(9.7602) = 9.8.
Roundup returns the smallest number, to one decimal place, that is equal to or higher than its input, so 9.7602 becomes 9.8. On the severity scale that is Critical. For contrast, the specification's example vector above (PR:H, C:L, I:L, A:N) works out to 3.8 by the same equations, which is Low.
What changed in CVSS v4.0
FIRST first published the CVSS v4.0 specification on 1 November 2023, and the current document version is 1.2. FIRST's CVSS navigation now files the v3.1 documents under a "CVSS v3.1 Archive" heading. The main changes, as the v4.0 specification describes them:
| Area | CVSS v3.1 | CVSS v4.0 |
|---|---|---|
| Metric groups | Base, Temporal, Environmental | Base, Threat, Environmental, Supplemental |
| New base metric | None | Attack Requirements (AT): None (N) or Present (P) |
| User Interaction | None, Required | None, Passive, Active |
| Scope | Scope (S): Unchanged or Changed | Replaced by separate Vulnerable System impacts (VC, VI, VA) and Subsequent System impacts (SC, SI, SA) |
| Time-based metrics | Temporal: E, RL, RC | Threat: Exploit Maturity (E) only, with values Attacked, Proof-of-Concept, Unreported and Not Defined |
| Vector order | Any order valid | Fixed order, every other ordering is invalid |
| Score calculation | Published equations | MacroVectors, a lookup table and interpolation |
The default for Security Requirements moved to the worst case. In v4.0 a Security Requirement of Not Defined has the same effect as High, whereas in v3.1 it had the same effect as Medium. The exploit default did not change in this way: v4.0 treats Exploit Maturity Not Defined as Attacked, and v3.1 already treated Exploit Code Maturity Not Defined the same as High.
The Supplemental group adds Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort and Provider Urgency. None of them changes the calculated score. They add context for your own prioritisation.
v4.0 also introduces labels that state which groups a score used: CVSS-B (Base), CVSS-BT (Base and Threat), CVSS-BE (Base and Environmental) and CVSS-BTE (all three). The specification notes that providers such as the National Vulnerability Database (NVD) typically provide only CVSS-B scores.
How this fits your exam
CompTIA CySA+ CS0-003: objective 2.3, "Given a scenario, analyze data to prioritize vulnerabilities", lists CVSS interpretation with attack vectors, attack complexity, privileges required, user interaction, scope and impact (confidentiality, integrity, availability). Those are the v3.1 base metrics, including Scope, which v4.0 no longer has. CompTIA says CS0-003 retires in English on 22 December 2026 and CySA+ V4 is available, so confirm your exam code. The CySA+ CS0-003 study guide covers the full exam.
CompTIA Security+ SY0-701: objective 4.3, "Explain various activities associated with vulnerability management", lists CVSS and CVE under Analysis, alongside prioritise, exposure factor, environmental variables and industry or organisational impact. CompTIA lists the SY0-701 English retirement date as 11 June 2027 and expects Security+ V8 to launch on or around 17 November 2026. See the Security+ SY0-701 study guide.
Frequently asked questions
Is a CVSS score a measure of risk?
Not by itself. Both specifications describe CVSS as measuring severity, and say organisations may feed it into a vulnerability management process that also considers factors outside CVSS, such as monetary losses from a breach or life or property threatened. The specifications state those factors are outside the scope of CVSS.
Why does a published score often show only base metrics?
The v3.1 specification says it is typical for only the Base metrics to be published, because they do not change over time and are common to all environments. Consumers are expected to add Temporal and Environmental values for their own situation. In v4.0 terms, a base-only score is labelled CVSS-B.
Can a v3.1 score and a v4.0 score be compared directly?
Not metric for metric. The two versions use different metrics and different scoring methods. The v4.0 specification says its severity bin boundaries were set to be backwards compatible with the qualitative severity boundaries from CVSS v3.x, and the five rating bands are identical in both specifications.
Sources
- Common Vulnerability Scoring System v3.1: Specification Document
- Common Vulnerability Scoring System version 4.0: Specification Document
- CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0
Test yourself on vector strings and severity bands with the CySA+ CS0-003 practice questions, and use the CySA+ exam guide to plan the rest of your study.