Home / Knowledge hub / CVSS 4.0
Knowledge hub
CVSS 4.0
The newest CVSS version, adding clearer threat and supplemental metrics.
What it means
CVSS 4.0 is the fourth major version of the Common Vulnerability Scoring System, published by FIRST in November 2023. It still turns a vulnerability into a score from 0 to 10, but it separates what is true of the flaw itself from what is true in your situation.
It has four metric groups: Base, Threat, Environmental and Supplemental. Supplemental metrics add context, such as whether an attack can be automated, but do not change the score. Version 4.0 also names which groups a score used, for example CVSS-B or CVSS-BTE.
Why it matters
Version 3.1 scores were often read as risk when they only described the flaw. A 9.8 for a bug that needs an unusual setup looked the same as a 9.8 that is being used against customers today. The new Threat group, which records exploit maturity, helps tell these apart, and the Environmental group lets you adjust a score to your own setup.
It also changes numbers. The same flaw can score differently under 3.1 and 4.0, so mixed reports confuse buyers and auditors. Know which version a score uses before you compare it against a policy, a contract clause or a service-level agreement, and record it next to the number.
How it shows up
You meet it in vulnerability databases and scanner output, usually beside the older version. The base group now includes attack requirements and separates impact on the vulnerable system from impact on later systems. User interaction has three values: none, passive and active. A string such as CVSS:4.0/AV:N/AC:L shows the inputs.
Do not stop at the base score. Add threat data, such as whether exploits exist (see exploit maturity), and your own environment, then weigh it against the likelihood of use in EPSS or the KEV catalog. Keep the vector string with the score so others can check it.
Questions people ask
CVSS 4.0, answered
Is CVSS 4.0 better than 3.1?
It is clearer about threat and environment, and it records more detail on impact. Whether it is better for you depends on how it is used.
Either way, it scores severity and not risk to your business.
Do we have to switch?
No one is forced to, but data sources are moving. Many databases publish both versions during the change.
Choose one for your policy and state it, so deadlines do not depend on which score a tool shows.
What do CVSS-B and CVSS-BTE mean?
They name which metric groups went into the score. B is Base alone. BT adds Threat, BE adds Environmental, and BTE uses all three.
A plain base score is the least specific to your situation.
What are the supplemental metrics?
Extra labels that do not change the number: safety, automatable, recovery, value density, vulnerability response effort and provider urgency.
They help you decide how to respond once you have the score.
How does it relate to CVSS 3.1?
Same family, same 0 to 10 range and similar severity bands, but a new formula and new metrics. Scores are not directly comparable between versions.
Always read the version in the vector string.
Sources
Where this comes from
Related
Terms that sit next to this one
CVSS
A scoring system that turns a vulnerability into a number out of ten.
CVSS vector
The short string that records each factor behind a CVSS score.
Exploit maturity
How developed and available attack code is for a given flaw.
EPSS
A score estimating how likely a vulnerability is to be exploited in the next thirty days.
Severity
How bad a finding is, from critical down to informational.
Is the score the whole story?
We keep severity and confidence apart, and every finding carries CWE and OWASP references plus the proof we exploited. A score is a starting point, not the answer. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.