What does CVSS stand for?
CVSS stands for Common Vulnerability Scoring System. A 0-10 scoring system for vulnerability severity based on factors such as attack vector, complexity, privileges needed and impact. Severity is not the same as your organization's risk.
CVSS is an open standard, maintained by FIRST, for rating the severity of a vulnerability from 0.0 to 10.0. The base score reflects the flaw itself: how it is reached, how complex the attack is, which privileges and user actions it needs, and the impact on confidentiality, integrity and availability. The qualitative bands are low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0). Severity is not the same as risk to your organization.
CVSS in practice: an example
Two flaws both score 9.8. One is on an internet-facing server that holds customer data; the other is on an isolated lab machine. The base score is the same, but the first is patched tonight and the second next week, because exposure and asset value differ.
What CVSS is confused with
CVSS vs CVE: what is the difference?
CVE identifies the flaw. CVSS scores it. What CVE stands for
CVSS vs EPSS: what is the difference?
CVSS measures how bad a flaw is. EPSS estimates how likely it is to be exploited in the next 30 days. Used together they prioritize better than either alone. What EPSS stands for
Which exams cover CVSS?
CVSS is on the official CompTIA acronym list for two of the four exams covered here.
- Security+ SY0-801: 2.1 (Threats, Vulnerabilities, and Attacks).
- CySA+ CS0-004: 2.3 (Vulnerability Management).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A vulnerability has a CVSS base score of 9.1. Which severity band is that?
- Medium
- High
- Critical
- Low
Show the answer
C. Critical. Scores from 9.0 to 10.0 are critical. High is 7.0 to 8.9.
2. Why should patch priority not be set from the CVSS base score alone?
- Base scores change every day
- The base score ignores your environment: exposure, asset value and existing controls
- CVSS only applies to hardware
- Scores above 7 are always false positives
Show the answer
B. The base score ignores your environment: exposure, asset value and existing controls. The base score describes the flaw in general. Risk depends on where the affected system sits and what it holds.
Sources: FIRST: Common Vulnerability Scoring System; NIST glossary: Common Vulnerability Scoring System. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.