Understanding CVE Identifiers, CVSS v3/v4 Vectors & Severity Scoring

Every single year, security researchers and threat actors discover tens of thousands of software security vulnerabilities across operating systems, enterprise software, network firmware, and open-source libraries. For security operations teams and systems engineers, attempting to remediate every single identified flaw without a standardized scoring framework is impossible. Without structured metrics, organizations waste critical engineering hours patching low-risk theoretical bugs while leaving exploitable zero-day vulnerabilities wide open.

To standardize vulnerability communication and remediation prioritization, the global cybersecurity industry relies on Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS).

The Common Vulnerabilities and Exposures (CVE) Program

Maintained by the MITRE Corporation and sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the CVE program provides a standardized, universal dictionary of publicly known cybersecurity vulnerabilities.

• Format: CVE-[Year]-[SequenceNumber] (e.g. CVE-2021-44228 for the Log4j vulnerability).
• CVE Numbering Authorities (CNAs): Organizations authorized to assign CVE IDs to newly discovered flaws (including major vendors like Microsoft, Red Hat, Apple, Google, and independent research bodies).
• National Vulnerability Database (NVD): Operated by NIST, the NVD synchronizes with MITRE's CVE list and enriches each entry with Common Platform Enumeration (CPE) software identifiers, patch links, and formal CVSS severity scores.

The Common Vulnerability Scoring System (CVSS)

Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS is an open, vendor-neutral framework that quantifies the severity of a vulnerability on a numerical scale from 0.0 to 10.0.

CVSS Framework Evolution: Metric Groups in v3.1 vs v4.0

A complete CVSS assessment evaluates a vulnerability across structured metric groups. FIRST updated these foundational groups between CVSS v3.1 and CVSS v4.0:

CVSS v3.1 Base Metrics & Vector Architecture

In CVSS v3.1, the Base score evaluates eight core concepts divided into Exploitability and Impact:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The eight CVSS v3.1 Base concepts are defined as follows:

• Attack Vector (AV): Network (N), Adjacent (A), Local (L), or Physical (P). Network indicates remote exploitable access across the internet.
• Attack Complexity (AC): Low (L) (no specialized execution conditions) or High (H) (requires race conditions, specific memory layout, or information leaks).
• Privileges Required (PR): None (N) (unauthenticated), Low (L) (standard user privileges), or High (H) (requires administrator/root).
• User Interaction (UI): None (N) (exploits silently without user action) or Required (R) (victim must click a malicious link or open a file).
• Scope (S): Unchanged (U) (impact confined to the vulnerable component) or Changed (C) (impact extends beyond the security authority of the vulnerable component to compromise the underlying host or operating system).
• Confidentiality Impact (C): None (N), Low (L), or High (H) (total loss of confidentiality / full disclosure).
• Integrity Impact (I): None (N), Low (L), or High (H) (total loss of system integrity / data modification).
• Availability Impact (A): None (N), Low (L), or High (H) (total loss of service availability / crash).

CVSS v4.0 Base Metrics & Architectural Modernization

Published by the Forum of Incident Response and Security Teams (FIRST), CVSS v4.0 provides substantial architectural refinements to eliminate ambiguity, resolve scoring inconsistencies, and provide granular impact modeling. CVSS v4.0 Base metrics comprise eleven distinct metrics:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The eleven CVSS v4.0 Base metrics are categorized into Exploitability and dual-tier Impact groups:

1. CVSS v4.0 Exploitability Metrics

• Attack Vector (AV): Network (N), Adjacent (A), Local (L), or Physical (P).
• Attack Complexity (AC): Low (L) or High (H). In v4.0, AC measures only defensive engineering barriers and evasion technologies (e.g. ASLR, DEP, or crypto-enforced controls).
• Attack Requirements (AT): None (N) or Present (P). Attack Requirements (AT) was added in v4.0 to isolate prerequisite execution conditions (such as race conditions, specific network injection placement, or execution dependencies) that were previously conflated into AC in v3.1.
• Privileges Required (PR): None (N), Low (L), or High (H).
• User Interaction (UI): Refined in v4.0 to None (N), Passive (P) (victim interacts involuntarily, e.g. browsing a page), or Active (A) (victim takes explicit sensitive action).

2. CVSS v4.0 Impact Metrics (Vulnerable System vs Subsequent System)

In CVSS v4.0, Scope was retired. In its place, impacts are split between Vulnerable System and Subsequent System to clearly distinguish immediate software compromise from downstream infrastructure fallout:

• Vulnerable System Impacts:
  • Vulnerable System Confidentiality (VC): High (H), Low (L), or None (N).
  • Vulnerable System Integrity (VI): High (H), Low (L), or None (N).
  • Vulnerable System Availability (VA): High (H), Low (L), or None (N).
• Subsequent System Impacts:
  • Subsequent System Confidentiality (SC): High (H), Low (L), or None (N).
  • Subsequent System Integrity (SI): High (H), Low (L), or None (N).
  • Subsequent System Availability (SA): High (H), Low (L), or None (N).

Summary

Vulnerability management is an essential pillar of enterprise security governance. By mastering CVE identifiers, parsing standardized CVSS Base vector strings, understanding the distinction between theoretical severity and real-world exploitability, and applying contextual environmental adjustments, security teams prioritize patching where it matters most to safeguard enterprise assets.