prioritizing-vulnerabilities-with-cvss-scoring

Assess the base metrics including attack vector, attack complexity, attack requirements, privileges required, user interaction, and impact on confidentiality, integrity, and availability. Then build a vector string like CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H and apply threat and environmental metrics.

Combine CVSS with EPSS exploit probability scores, CISA KEV catalog listings, asset criticality from your CMDB, and network exposure data. A weighted matrix using roughly 25% CVSS, 25% EPSS, 20% asset criticality, 15% KEV, and 15% exposure produces more realistic priorities.

CVSS v4.0 adds Attack Requirements and Supplemental metrics like Safety, Automatable, and Recovery, expands User Interaction values, and splits impact metrics between vulnerable and subsequent systems. It was released by FIRST in November 2023 for more accurate scoring.

No, CVSS measures intrinsic severity, not organizational risk. Treating base scores as the sole prioritization factor is a common pitfall; you must apply environmental metrics and threat intelligence like EPSS and KEV to reflect real deployment context.

Vulnerabilities scoring 9.0–10.0 with EPSS above 0.5 on Tier 1 assets warrant P1 emergency handling with 24–48 hour remediation. Scores of 7.0–8.9 typically map to 7–14 day SLAs depending on exploit probability and asset tier.