What does a CVSS score actually mean?
CVSS is a 0–10 severity score describing how bad a vulnerability would be if exploited. In CVSS v3.1 the bands are Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. The score most people quote is the Base score, which measures intrinsic severity only — it says nothing about whether anyone is actually exploiting the flaw.
That last point is where most patching programmes go wrong. A CVSS 9.8 on a product you do not run, that no attacker has ever weaponised, is less urgent than a CVSS 7.5 in your internet-facing VPN that a ransomware crew is exploiting this week.
CVSS defines Base, Threat (formerly Temporal) and Environmental metric groups. Almost everyone publishes and consumes only the Base score, which is precisely the group that deliberately excludes your environment and current attacker behaviour.
Used well, CVSS answers "how bad could this be?" Pair it with exploitation evidence — CISA KEV for confirmed in-the-wild use, EPSS for probability — to answer "how urgent is this for us?"
Related coverage
CVE & Vulnerabilitiesdispatches →Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.
More on prioritisation