CVSS v3.1 Explained: How to Read and Use Vulnerability Scores

The Common Vulnerability Scoring System (CVSS) is the industry standard for communicating the severity of security vulnerabilities. Yet many security teams misapply CVSS scores — treating them as absolute risk ratings rather than the contextual tools they are.

The Three Score Types

Base Score

Reflects the intrinsic characteristics of a vulnerability — independent of time or environment. Ranges from 0.0 to 10.0.

Temporal Score

Adjusts the base score based on factors that change over time:

• Exploit Code Maturity — is working exploit code publicly available?
• Remediation Level — is an official patch available?
• Report Confidence — how confirmed is the vulnerability?

Environmental Score

Adjusts for your specific environment:

• How critical is the affected system to your organisation?
• What compensating controls do you have in place?

The Eight Base Metrics

Common Mistakes

Mistake 1: Treating CVSS as absolute risk A CVSS 9.8 vulnerability on an isolated internal system with no network exposure may be lower priority than a CVSS 6.5 vulnerability on an internet-facing authentication service.

Mistake 2: Ignoring the Environmental Score Always calculate the Environmental Score for your context. A vulnerability affecting a system you don't use is irrelevant regardless of its Base Score.

Try the Calculator

Use the Cyber121 CVSS Calculator to compute Base, Temporal, and Environmental scores interactively. Select each metric and see the score update in real time with the full vector string.