How CVSS works
A CVSS score is calculated from a set of metrics. Base metrics describe the intrinsic qualities of a flaw, such as whether it can be exploited over a network, how complex the attack is, whether privileges or user interaction are needed, and the effect on the CIA triad.
Temporal and environmental metrics can adjust the result for exploit availability and for the importance of the affected asset. Scores map to ratings: none, low, medium, high, and critical. Different versions exist, so always note whether a score is from version 3.1 or 4.0.
Why it matters for Canadian organizations
Most organizations face more vulnerabilities than they can fix at once, so ranking is unavoidable. CVSS provides a common, vendor-neutral starting point that appears in advisories from vendors and the Canadian Centre for Cyber Security.
However, a high score does not always mean high risk for you. A critical flaw on an isolated test system may matter less than a medium one on an internet-facing server holding personal data. Regulators and auditors expect a documented, risk-based remediation process, which CVSS supports when combined with context.
How to implement it
Use CVSS as an input to prioritization, not the only one. Combine it with evidence of active exploitation, exposure to the internet, asset criticality, and the presence of compensating controls. Lists of known exploited vulnerabilities are valuable signals.
Set remediation targets by severity, for example faster timelines for critical and exposed systems, and track compliance with them. Document exceptions and review them regularly. Vulnerability management programs often add a risk-based layer on top of raw scores to focus effort effectively. Re-score periodically as new exploit information appears.
Frequently asked questions
What is a critical CVSS score?
In CVSS v3 and v4, scores from 9.0 to 10.0 are rated critical. These usually indicate flaws that are easy to exploit remotely with severe impact, but you should still weigh exposure and asset importance when prioritizing. Always record which CVSS version produced the number you are comparing.
Is CVSS the same as CVE?
No. CVE is an identifier for a specific vulnerability, while CVSS is a scoring system for its severity. A CVE entry often has a CVSS score attached in databases such as the National Vulnerability Database.
Should I patch based on CVSS alone?
It is better not to. Add context such as active exploitation, internet exposure, the value of the affected system, and available mitigations. Two flaws with the same score can pose very different risk to your business.
Related service: Vulnerability management