Definition
CVSS, the Common Vulnerability Scoring System, is an open industry standard for assessing the severity of computer system security vulnerabilities. It provides a numerical score from 0.0 to 10.0, indicating the potential impact and exploitability of a weakness. CVSS works by evaluating several metrics, including attack vector, complexity, privileges required, user interaction, and scope, along with impact metrics for confidentiality, integrity, and availability. This scoring system helps organizations prioritize patching and remediation efforts by focusing on the most critical threats first. For instance, a critical vulnerability allowing remote code execution with no user interaction would receive a high CVSS score. It is important to distinguish CVSS scores from risk assessments, as CVSS provides a standardized severity rating, not a complete risk picture. CVSS is a key concept tested on CompTIA Security+, CySA+, and CISSP certifications.