[{"data":1,"prerenderedAt":145},["ShallowReactive",2],{"publication:en:P148":3},{"meta":4,"copy":16,"relatedArticles":131,"terms":132,"term":133,"resourceParent":139,"glossaryParent":142},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15},"P148","\u002Fglossary\u002Fcvss","term","what is CVSS","What is CVSS? Vulnerability severity, vectors and business context","What is CVSS? Severity scores and their limits","Read a CVSS score with its version, vector and assessment context. Distinguish technical severity from exploitation evidence and your business repair priority.",[13,14],"\u002Fservices\u002Fsecurity-audit","\u002Fblog\u002Fwordpress-plugin-vulnerability-response","2026-10-30",{"intro":17,"sections":18,"checklistTitle":87,"checklist":88,"faq":96,"sources":106,"links":109,"cta":126},"CVSS (Common Vulnerability Scoring System) describes vulnerability characteristics and technical severity using a versioned method and vector. A base score is not a complete measure of business risk or proof of exploitation. Read the score with its version, metrics, source and assumptions, then combine it with local exposure, threat evidence and the business function affected.",[19,28,60,65,74,82],{"title":20,"paragraphs":21,"sources":24},"Read the version and vector beside the displayed score",[22,23],"A numeric rating is a shorthand for an assessment, while the vector records the metric choices behind it. FIRST's CVSS guidance describes the framework and its technical severity purpose. Record the version and the assessment source before comparing two scores. A bare number in a dashboard can hide different assumptions or a different scoring version.","Ask what the assessment says about the weakness rather than treating the number as a universal repair deadline. A vendor and another assessor may publish different vectors that need explanation. Keep both sources and identify the reason for the difference. Do not average them into a new score without a justified method or claim one is current merely because it appears in the newest screenshot.",[25],{"label":26,"url":27},"FIRST: CVSS v4.0 characteristics, vectors and severity limits","https:\u002F\u002Fwww.first.org\u002Fcvss\u002Fv4.0\u002Ffaq",{"title":29,"paragraphs":30,"table":33},"Distinguish technical severity from the local decision",[31,32],"Technical severity describes characteristics of the vulnerability under the assessed conditions. The business must still determine whether the affected product is installed, the prerequisites apply and the relevant path is reachable. A severe issue in software that is not present is a different decision from a matching weakness on a critical exposed service.","FIRST explicitly states that CVSS base scores are not risk and should not be used alone for patch prioritization. That does not make the score useless; it makes the rest of the review necessary. Keep applicability, exposure and operational impact beside the severity evidence so the person approving a change understands why this item is being addressed now.",{"caption":34,"headers":35,"rows":39},"CVSS assessment and business-context worksheet",[36,37,38],"Input","What to retain","What it cannot establish alone",[40,44,48,52,56],[41,42,43],"Version and source","Scoring version, assessor and observation date.","Identical methodology across different reports.",[45,46,47],"Vector","Metric choices and the relevant assumptions.","The local installation has those conditions.",[49,50,51],"Technical severity","Published assessment and rationale.","A site-specific likelihood or financial loss.",[53,54,55],"Threat evidence","Known exploitation or a dated forecast.","Confirmed compromise of this business.",[57,58,59],"Local context","Asset, exposure, function and controls.","A supported repair has already passed acceptance.",{"title":61,"paragraphs":62},"Understand additional context without inventing a new rating",[63,64],"CVSS v4.0 organizes information into Base, Threat, Environmental and Supplemental metric groups. Those distinctions provide a way to communicate more context than a base shorthand. Use the current version's own rules and nomenclature when a qualified assessment includes additional information. Do not mix metric labels from different versions as though they describe one consistent vector.","For a small business, the useful operational record can remain plain language: which function is affected, how it is exposed, who can reach it and which supported controls exist. If you cannot produce a valid contextual score, leave the narrative evidence clear instead of inventing a numeric result. A transparent decision is more useful than false precision.",{"title":66,"paragraphs":67,"sources":70},"Keep EPSS and known exploitation in their own columns",[68,69],"EPSS estimates exploitation activity over a defined forward-looking window; its probability and percentile are different values. FIRST's EPSS FAQ distinguishes that forecast from technical severity and confirmed historical exploitation. Neither output is a measurement that your particular website has been compromised. Retain its date and meaning when it informs a review.","Known exploitation is a reason to reassess an applicable exposed system promptly, while a low forecast does not erase other evidence. Do not multiply a CVSS score and EPSS value into an unexplained business-risk number. The result would obscure the differences between ordinal severity, forecast probability, local exposure and business consequence.",[71],{"label":72,"url":73},"FIRST: EPSS probability, percentile and exploitation forecast","https:\u002F\u002Fwww.first.org\u002Fepss\u002Ffaq",{"title":75,"paragraphs":76,"example":79},"Use the assessment to support an owned repair decision",[77,78],"Review vendor guidance and the installed component before choosing a patch, mitigation, restriction or replacement. Identify business dependencies and the person authorized to accept a change. A queue sorted by the largest number may ignore a directly applicable exploited issue or a repair that needs immediate containment before a normal release window.","Record why an item advances, waits or needs further evidence. Give temporary controls and exceptions an owner and review point. After implementation, verify the relevant technical condition and normal business workflow. An updated severity feed or lower dashboard count does not establish that the intended installation was corrected or that connected forms and orders still work.",{"title":80,"text":81},"Illustrative severity-versus-priority decision","Two findings have different published severities. The higher one concerns a product not installed; the other matches an exposed business component and relevant exploitation evidence. The owner validates both records and prioritizes from applicability and context rather than the number alone.",{"title":83,"paragraphs":84},"Preserve the reasoning when scores or systems change",[85,86],"Keep the reviewed vector, source, date and local decision in the maintenance record. Reassess when the environment, vendor information or threat evidence changes. A different score later does not automatically invalidate the earlier decision; the record should show which facts were available and which conditions changed.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli website and digital-infrastructure knowledge. We can scope the technical review and connect vulnerability evidence with supported changes and acceptance. The handover should explain the priority and its limits so a business owner can act without interpreting a severity number as a security guarantee.","CVSS interpretation questions",[89,90,91,92,93,94,95],"Version, vector, source and date recorded","Metric assumptions read alongside the number","Affected installation and exposure verified","Business impact separated from technical severity","EPSS probability, percentile and known exploitation distinguished","Repair or exception has an accountable owner","Actual correction and business function verified",[97,100,103],{"question":98,"answer":99},"Is a CVSS base score the risk to my company?","No, it communicates technical severity under its assessment assumptions. Local applicability, exposure, threat evidence, business impact and controls still need review. FIRST cautions against using base scores alone for patch prioritization.",{"question":101,"answer":102},"Can we compare scores without knowing their version?","Keep the version and vector with every comparison. Different scoring methods or assumptions may produce different assessments. Review the source and rationale instead of treating every displayed number as directly interchangeable.",{"question":104,"answer":105},"Does a low EPSS forecast cancel a high CVSS score?","No, they describe different things. Preserve technical severity, dated forecast and known exploitation evidence separately, then assess the actual system and business context. No single value settles the complete repair decision.",[107,108],{"label":26,"url":27},{"label":72,"url":73},[110,113,116,119,122,124],{"path":111,"label":112},"\u002Fglossary\u002Fcve","Understand the vulnerability identifier",{"path":114,"label":115},"\u002Fblog\u002Fvulnerability-prioritization","Build an owned repair-priority register",{"path":117,"label":118},"\u002Fglossary\u002Fvulnerability-scanning","Interpret automated findings within their scope",{"path":120,"label":121},"\u002Fglossary\u002Fplugin-vulnerability","Check the actual component and prerequisites",{"path":13,"label":123},"Scope a vulnerability and configuration review",{"path":14,"label":125},"Plan a supported plugin correction",{"title":127,"description":128,"button":129,"type":130},"Translate the severity report into a practical next step","Describe the affected component and report. We can clarify applicability, priority and the checks needed after a supported change.","Discuss vulnerability severity and priority","check",[],[],{"name":134,"aliases":135},"CVSS (Common Vulnerability Scoring System)",[136,137,138],"severity vector","Common Vulnerability Scoring System","CVSS v4.0",{"path":140,"label":141},"\u002Fresources","Website security resources and templates",{"path":143,"label":144},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134057851]