What to Expect for CVSS v4.0

CVSS v4.0 is composed of four metric groups: Base Metrics, Environmental Metrics, Threat Metrics and Supplemental Metrics, the latter two of which are new additions.

The Base Metrics in CVSS v4 removes the Scope metric and adds the Attack Requirements (AT) which indicates specific environmental conditions that must be present for the exploitation to occur.

Threat Metrics: Real-World Exploitation

The Threat Metrics group introduces a new element: Exploit Maturity (E). Exploit Maturity describes how easily and widely a vulnerability is exploited. This metric helps security professionals distinguish whether a vulnerability is a theoretical risk or a live threat, a capability CVSS v3.1 did not provide.

Environmental Metrics: Organizational Context

CVSS v4 allows users to customize the score based on their specific systems or organizational priorities. Metrics here include the Modified Base Metrics, which adjusts the Base Metrics to match the real-world implementation of a system, and Security Requirements, which emphasizes which impact area (C,I,A) is most important to the organization.

This level of customization makes CVSS v4.0 much more adaptable to a wide range of industries, including healthcare, finance, and industrial control systems, where risk tolerances and operational requirements vary.

Supplemental Metrics: Additional Insight

Supplemental Metrics do not affect the CVSS numeric score but provide valuable, qualitative information. These include Safety (S), which assesses whether exploitation could lead to physical harm or safety risks, and Automatable (AU), which evaluates the ease with which an exploit can be executed using scripts or tools. Recovery (R) reflects how easily affected systems can be restored, while Value Density (V) indicates how much sensitive data or value is concentrated in the affected system. Vulnerability Response Effort (RE) helps organizations plan and prioritize their response efforts based on the level of effort required rather than severity alone. Finally, Provider Urgency (U) allows vendors to communicate the urgency of applying a fix. Together, these metrics help organizations gain a more comprehensive understanding of the potential consequences of a vulnerability beyond just its technical severity.

Calculations of CVSS v4.0

The development of the CVSS v4.0 scoring system involves a structured, data-driven approach to ensure consistency, expert input, and backward compatibility. First, the CVSS Special Interest Group (SIG) combined 15 million possible CVSS-BTE (Base, Threat, Environmental metrics) vectors into 270 equivalence sets (metric groups) to make expert analysis manageable. Experts can then compare these sets to determine relative severity, using pairwise comparisons, which are then processed using the Elo rating system to create a severity ranking of the vector groups. The Elo algorithm used to rank severities is the same as the algorithm used by the International Chess Federation to rank chess players from best to worst.

The SIG requested input from industry experts to define the boundaries between qualitative severity levels (low, medium, high, critical) in a way that aligns with the CVSS v3.x score ranges. These ranked vector groups within each severity categories are then mapped to the corresponding numerical score ranges using agglomerative hierarchical clustering. The SIG also introduced a score adjustment mechanism to meet the design goal that any single metric change results in at least a 0.1 point difference in score. This allows slight variations within vector groups based on ordered metric values (AV:N > AV:A > AV:L >AV:P), ensuring that similar but not identical vectors have slightly different scores.

Advantages of CVSS v4.0

CVSS v4.0 brings a range of improvements over its predecessor, offering several key advantages that enhance vulnerability assessment and prioritization. One of the most significant improvements is greater accuracy, achieved through the inclusion of Attack Requirements and Threat Metrics. These additions enable a more precise understanding of a vulnerability’s exploitability and urgency. CVSS v4.0 also introduces real-world context awareness, helping organizations focus their efforts on vulnerabilities that pose immediate threats. The framework’s environmental flexibility allows scores to be tailored to an organization’s specific context, increasing the relevancy of the assessment and improving prioritization decisions. Furthermore, the addition of Supplemental Metrics provides valuable contextual information, particularly benefiting complex environments such as those in industries with strict operational or safety requirements.

Disadvantages and Challenges of CVSS v4.0

Despite its advancements, CVSS v4.0 introduces several complexities and limitations that may present challenges for users. With the introduction of more metrics and score types, CVSS v4.0 can be more difficult to learn and apply, particularly for smaller organizations or less experienced users. Additionally, the flexibility intended to support contextual scoring may lead to inconsistencies across organizations. This means that two different teams might assign very different scores to the same vulnerability, making it harder to perform reliable cross-organizational comparisons. Another limitation is that the Supplemental Metrics, while informative, do not contribute to the actual score. As a result, organizations may inadvertently overlook important qualitative factors when prioritizing vulnerabilities. Finally, although CVSS v4.0 maintains a similar scoring range to v3.1, the inclusion of new metrics and revised interpretation methods limits backward compatibility. This can cause discrepancies when comparing scores across versions and may require existing tools to be updated or reconfigured.