CVSS 4.0 explained: metrics, scoring and what changed from CVSS 3.1

CVSS 4.0 is the current version of the Common Vulnerability Scoring System, published by FIRST on November 1, 2023. Compared with CVSS 3.1 it adds an Attack Requirements metric, splits User Interaction into Passive and Active, drops the Scope metric in favour of separate impacts on the vulnerable and subsequent systems, slims the old Temporal group down to a single Exploit Maturity metric, and adds optional Supplemental metrics that never change the number. Scores still run from 0.0 to 10.0 with the same severity bands, but they are calculated differently, so a 3.1 score and a 4.0 score for the same bug often do not match.

This guide is based on the CVSS v4.0 specification (current revision 1.2, dated June 18, 2024) and the official user guide.

The four metric groups in CVSS 4.0

CVSS 4.0 organises its metrics into four groups. Only the first three can affect the score.

• Base: the intrinsic properties of the vulnerability that do not change over time or between environments. Vendors and databases usually publish only this group.
• Threat: the renamed and simplified version of the 3.1 Temporal group. It contains one metric, Exploit Maturity.
• Environmental: how much the affected asset matters to you, plus "modified" versions of the Base metrics that reflect your own controls.
• Supplemental: extra context for decision-making. These metrics are informational and have no effect on the calculated score.

Score nomenclature: CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE

Because a single "CVSS score" can mean very different things, version 4.0 asks everyone to label which groups went into it:

• CVSS-B: Base metrics only.
• CVSS-BT: Base plus Threat metrics.
• CVSS-BE: Base plus Environmental metrics.
• CVSS-BTE: Base, Threat and Environmental metrics together.

The user guide is explicit that a CVSS-B score measures severity, not risk. It describes CVSS-BTE as the score that comes much closer to risk when an organisation fills in Threat and Environmental data.

Base metrics: what changed from CVSS 3.1

The Base group now has eleven metrics. Here they are with their abbreviations and allowed values:

• Attack Vector (AV): Network, Adjacent, Local, Physical. Unchanged from 3.1.
• Attack Complexity (AC): Low, High. In 4.0 it is narrowed to what an attacker must do to get around security-enhancing measures such as ASLR or DEP, or to obtain a target-specific secret such as a key.
• Attack Requirements (AT): None, Present. New. It captures deployment or execution conditions on the vulnerable system that must exist for the attack to work, such as a race condition the attacker needs to win.
• Privileges Required (PR): None, Low, High.
• User Interaction (UI): None, Passive, Active. In 3.1 this was a yes/no choice. Passive means a user is involved only involuntarily; Active means the user has to take specific, conscious steps, such as importing a file or clicking through a warning.
• Vulnerable System impacts (VC, VI, VA): confidentiality, integrity and availability impact on the system that contains the flaw. Each is High, Low or None.
• Subsequent System impacts (SC, SI, SA): impact on other systems beyond the vulnerable one. Also High, Low or None.

Why Scope was removed

In CVSS 3.1, the Scope metric (Unchanged or Changed) tried to express whether a flaw in one component could affect others, such as a VM escape or a cross-site scripting bug. Version 4.0 replaces it with two explicit sets of impact metrics, so instead of a single toggle you state the confidentiality, integrity and availability effects on the vulnerable system and on subsequent systems separately.

Threat metrics: Exploit Maturity

The 3.1 Temporal group had three metrics: Exploit Code Maturity, Remediation Level and Report Confidence. Version 4.0 retires the last two and keeps one metric, Exploit Maturity (E), with these values:

• Attacked (A): attacks have been reported, or tools that make exploitation easier are available, publicly or privately.
• Proof-of-Concept (P): proof-of-concept exploit code is public, but no attacks or exploit toolkits are known.
• Unreported (U): neither of the above is known.
• Not Defined (X): the default, which the calculation treats as Attacked, the worst case.

That default matters. A CVSS-B score assumes the worst-case threat, so adding Threat data can only keep the score the same or lower it.

Environmental metrics

The Environmental group lets a defender tailor the score to a specific deployment:

• Security requirements (CR, IR, AR): how important confidentiality, integrity and availability are for the affected asset (High, Medium, Low or Not Defined, which is scored as High).
• Modified Base metrics: MAV, MAC, MAT, MPR, MUI, MVC, MVI, MVA, MSC, MSI and MSA. They override the Base values when your configuration or mitigations change the picture, for example a service that is only reachable on an internal network.

One addition is specific to safety: the modified subsequent-system integrity and availability metrics (MSI and MSA) accept a value of Safety (S), for cases where exploitation could lead to physical harm. The guide's definition of "system" explicitly includes industrial control and OT systems.

Supplemental metrics (they do not change the score)

The new Supplemental group gives vendors and consumers a common vocabulary for context that is useful for prioritising work but deliberately kept out of the number:

• Safety (S): Negligible or Present.
• Automatable (AU): No or Yes, meaning whether an attacker can automate the kill-chain steps across many targets.
• Recovery (R): Automatic, User or Irrecoverable.
• Value Density (V): Diffuse or Concentrated, depending on how many resources a single successful attack gains.
• Vulnerability Response Effort (RE): Low, Moderate or High.
• Provider Urgency (U): Clear, Green, Amber or Red, set by the provider.

Each also has a Not Defined value.

How the CVSS 4.0 score is calculated

CVSS 3.1 used a closed-form formula. CVSS 4.0 does not. Instead, every possible vector is mapped to a MacroVector, a bucket of vectors that expert reviewers rated as roughly equally severe, defined by six equivalence sets (EQ1 to EQ6). Each MacroVector has a score taken from a lookup table that was built from expert ratings. The final score is then interpolated from that MacroVector's value, reduced in proportion to how far the actual vector sits from the most severe vector in the group, and rounded to one decimal place.

In practice nobody computes this by hand. FIRST hosts an official CVSS 4.0 calculator, and open-source libraries implement the same lookup tables for use in scanners and pipelines.

Severity ratings and score range

The qualitative scale is the same as in CVSS 3.1:

• None: 0.0
• Low: 0.1 to 3.9
• Medium: 4.0 to 6.9
• High: 7.0 to 8.9
• Critical: 9.0 to 10.0

Walking through a real vector string

Take a classic unauthenticated remote code execution: reachable over the network, no special conditions, no privileges, no user interaction, full compromise of the vulnerable system and no effect on other systems. In CVSS 3.1 that is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. In CVSS 4.0 it is written as:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Reading it left to right: the CVSS:4.0 prefix, then Network attack vector, Low complexity, no Attack Requirements, no privileges, no user interaction, High impact on the vulnerable system's confidentiality, integrity and availability, and None for all three subsequent-system impacts. The CVSS-B score is 9.3 (Critical).

Now see how the other groups move it, using the reference lookup tables:

• Add /E:P (public proof of concept, no known attacks): CVSS-BT drops to 8.9, High.
• Add /E:U instead (no known exploit or PoC): CVSS-BT drops to 8.1, High.
• Change AT:N to AT:P in the Base vector (a precondition must be met): CVSS-B becomes 9.2.
• Append Supplemental metrics such as /S:N/AU:Y/R:U: the score stays at 9.3.

The lesson is that a 4.0 Base score of 9.3 and a 3.1 Base score of 9.8 can describe the same bug. Do not compare numbers across versions, and do not assume that a lower 4.0 number means the flaw got less serious.

Using CVSS 4.0 in practice

• Always record the version and the label. Store the full vector string, not only the number, and note whether it is CVSS-B or CVSS-BTE.
• Keep thresholds version-aware. SLA rules written as "fix everything 9.0 and above" will catch a different set of findings under 4.0 than under 3.1.
• Feed in Threat data. Exploit Maturity defaults to Attacked, so CVSS-B is a worst-case figure. Known-exploited lists such as CISA's KEV catalogue, covered in our BOD 26-04 remediation guide, are a direct input for the E metric.
• Use Supplemental metrics for triage, not scoring. Automatable and Provider Urgency are useful filters precisely because they leave the number alone.

For more on individual flaws and how they are rated, see our vulnerabilities coverage and the wider security section. If you plan patch windows around these scores, the vendor patch calendar lists the monthly release dates.

Frequently asked questions

What is the difference between CVSS 4.0 and 3.1?

CVSS 4.0 adds Attack Requirements, splits User Interaction into Passive and Active, replaces Scope with separate vulnerable-system and subsequent-system impacts, reduces the Threat group to Exploit Maturity and adds non-scoring Supplemental metrics. It also calculates scores from MacroVector lookup tables rather than a formula.

What does CVSS-BT mean?

CVSS-BT is a CVSS 4.0 score calculated from the Base and Threat metric groups. In practice it is the Base score adjusted by Exploit Maturity, which can lower the score when no attacks or public exploits are known.

What is the CVSS 4.0 score range?

Scores run from 0.0 to 10.0. The severity bands are None (0.0), Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0), the same as in CVSS 3.1.

Do CVSS 4.0 supplemental metrics affect the score?

No. The specification states that Supplemental metrics such as Safety, Automatable and Provider Urgency have no impact on the calculated score; they only add context for prioritisation.

Where is the official CVSS 4.0 calculator?

FIRST publishes the reference calculator at first.org/cvss/calculator/4.0. It uses the same lookup tables defined by the specification.