Home / Knowledge hub / CVSS vector
Knowledge hub
CVSS vector
The short string that records each factor behind a CVSS score.
What it means
A CVSS vector is a compact text string that lists the value chosen for each metric behind a CVSS score. A typical one reads CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Each pair is a question and its answer: network or local access, low or high complexity, whether privileges are needed, and so on.
The score is a number calculated from the vector. The vector is the working. Two flaws can share a score of 7.5 for entirely different reasons, and only the string shows which. FIRST, which maintains the standard, publishes the formulas, so anyone can recompute the number from the string and check it.
Why it matters
Without the vector, a score is an opinion you cannot question. With it, your team can see that a flaw was rated as needing no sign-in when it actually needs one, and that single letter can move a finding from critical to medium. It turns an argument about severity into a short, checkable conversation.
It also travels well. Vectors are stored in advisories, scanner exports and ticketing tools, and they let you sort or filter by one factor, such as every flaw reachable over the network. When a customer or auditor asks how you rated something, the string answers in one line. See also CVSS.
How it shows up
You will find vectors beside nearly every entry in the CVE system and in the National Vulnerability Database. Reports from testers and scanners often carry one per finding. The prefix tells you the version, and version 4.0 uses a different set of metrics from 3.1, so strings from the two cannot be compared letter for letter.
The common mistake is copying a vendor's vector without checking it against your own case. A flaw rated as needing no privileges may sit behind a login in your app, and the reverse can also be true. Read the string, check each letter against how your system really behaves, and keep the corrected version with the finding.
Questions people ask
CVSS vector, answered
How do I read a CVSS vector?
Read it left to right as pairs. AV:N means attack vector is network, PR:N means no privileges required, C:H means high impact on confidentiality. The first part, CVSS:3.1, names the version.
FIRST publishes a full list of what every abbreviation means in the specification document.
Is the CVSS vector the same as the CVSS score?
No. The vector is the set of inputs and the score is the number calculated from them. Many different vectors can produce the same score.
If you only store the number, you lose the reasoning and cannot adjust it later when your own situation differs.
Can I change a vector for my own environment?
Yes, within limits. The base metrics describe the flaw itself and should stay as published. The environmental metrics exist for you to adjust for your own setup, such as how much confidentiality matters in that system.
Keep both the original and your adjusted vector so the change is visible.
Why does the same CVE have different vectors in different places?
Different parties score independently. The vendor, the National Vulnerability Database and a researcher may each publish a vector and may disagree on one or two metrics.
Compare the strings letter by letter to find the difference, then decide which matches how the flaw behaves in your product.
Does a vector tell me how likely an attack is?
No. A vector describes how bad a flaw is and how it can be reached. It does not say whether anyone is using it.
For likelihood, pair it with a signal such as EPSS or the CISA known exploited list.
Sources
Where this comes from
Related
Terms that sit next to this one
CVSS
A scoring system that turns a vulnerability into a number out of ten.
CVSS 4.0
The newest CVSS version, adding clearer threat and supplemental metrics.
CVSS environmental score
A CVSS score adjusted for how the flaw affects your own setup.
Severity vs confidence
How bad a finding is, kept apart from how sure the tester is that it is real.
EPSS
A score estimating how likely a vulnerability is to be exploited in the next thirty days.
Is the score on your finding right?
Each finding we report carries severity and confidence kept apart, with CWE and OWASP references, so the rating can be checked rather than trusted. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.