CVSS Scores Explained: What 9.8 Really Means
Why a 9.8 can be harmless to you and a 6.5 an emergency. How CVSS is built, what it ignores, and how to re-score a vuln for your own stack.
Short answer
CVSS estimates severity under abstract conditions. A 9.8 on software you do not run is noise. A medium score on an internet-facing unauthenticated path can be tonight's work.
What CVSS ignores
Your architecture, compensating controls, and whether a working exploit is in the wild.
That is why KEV and EPSS exist - they add likelihood and real-world exploitation context.
Readers skimming cvss score explained often stop at definitions. The part that prevents incidents is the verification step after the change - and the habit of re-checking after the next deploy that touches the same layer.
How to re-score locally
Ask about authentication required, network exposure, and data impact for your deployment.
Write the decision down so the team stops re-arguing every advisory from scratch.
Common failure mode for cvss score explained: staging looks fine, production still serves the old config because a CDN, load balancer, or second vhost was never updated. Always verify the hostname customers hit.
Common misuse
Sorting the entire backlog only by CVSS creates busywork on unreachable 9s while exposed mediums sit open.
Severity is an input. Exposure and exploitability decide the order.
If this section on cvss score explained becomes a recurring ticket, automate the check. Manual one-offs rot; a post-deploy assertion or weekly grade keeps the control honest.
What to do this week
- Take the top open CVE on your list.
- Re-score with exposure + auth requirements written down.
- Cross-check KEV/EPSS.
- Reorder the queue if priority changed.
Severity is not the same as priority on your network.
Update log (1)
2026-06-14Editorial form rewrite for length and uniqueness.
Sources + verification
Practical guidance based on mainstream browser behavior, common reverse-proxy configuration, and widely published RFCs and vendor docs. Verify on your own stack with curl, browser devtools, and a re-scan after each change.
