The Common Vulnerability Scoring System (CVSS) is an open framework for rating the severity of security vulnerabilities on a numerical scale from 0.0 to 10.0.
CVSS builds a score from several metric groups. Base metrics describe the intrinsic characteristics of a flaw, such as the attack vector and its impact on confidentiality, integrity, and availability. Temporal metrics reflect factors that change over time, and environmental metrics let an organization adjust the score for its own setting. The base score is the value most often quoted, and vendors map ranges to labels such as low, medium, high, and critical. The framework is maintained by FIRST.
A common mistake is treating the base score as the final word. A vulnerability rated critical on paper may pose little real risk if the affected system is isolated, while a medium score can be urgent on an internet-facing server. CVSS measures severity, not risk, so it should feed prioritization rather than replace judgment about exposure and business impact.
Why does CVSS matter for the CISSP exam?
CVSS lives in Domain 6, Security Assessment and Testing, alongside vulnerability management and results interpretation. Questions test whether you understand what the score represents and where its limits are. Study it in Domain 6 Security Assessment and Testing.