Vulnerability Management · Topic 3 of 5
CVSS and Risk Based Prioritisation
Prioritise vulnerabilities for CySA+ using CVSS metrics and severity bands, then adjust with EPSS, the KEV catalogue, exposure and business context.
- 5 min
- CVSS scores severity from 0.0 to 10.0, and 9.0 or above is Critical in version 3.x.
- The base metrics are attack vector, complexity, privileges, user interaction, scope and the three impact values.
- Base is the intrinsic score, temporal or threat changes over time, and environmental adapts it to your systems.
What it is
Every scan produces more findings than a team can fix at once. Prioritisation decides which ones to fix first, based on how much risk each one creates for the business.
A single score is not enough. The Common Vulnerability Scoring System (CVSS) rates how severe a flaw is in general, and the analyst then adds information about the threat and about the affected asset.
How it works
CVSS in brief
CVSS is an open standard that turns the characteristics of a vulnerability into a score from 0.0 to 10.0. The base score describes the flaw itself and does not change with the environment.
The version 3.x base metrics are:
| Metric | What it asks |
|---|---|
| Attack vector (AV) | How far away can the attacker be: network, adjacent, local or physical |
| Attack complexity (AC) | Do special conditions have to be right, low or high |
| Privileges required (PR) | Does the attacker need an account first: none, low or high |
| User interaction (UI) | Must a user do something: none or required |
| Scope (S) | Does the impact cross to another security authority: unchanged or changed |
| Confidentiality, integrity, availability (C, I, A) | How much damage to each: none, low or high |
A remotely reachable flaw that needs no privileges or user action and has full impact scores very high. The vector string captures the choices:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, Critical)| Score | Severity (version 3.x) |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
CVSS also has an optional temporal group for factors that change over time, such as exploit code maturity and fix availability. An environmental group lets you adjust the score for your own systems. Version 4.0 keeps the idea but renames temporal to threat, adds an attack requirements metric and separates impact on the vulnerable system from impact on other systems.
Adding threat information
- Exploit Prediction Scoring System (EPSS): estimates the probability that a vulnerability will be exploited in the wild in the near term (the next 30 days).
- Known Exploited Vulnerabilities (KEV) catalogue: a list kept by the US Cybersecurity and Infrastructure Security Agency (CISA) of flaws known to be exploited. A listed flaw is a strong reason to act quickly.
- Stakeholder-Specific Vulnerability Categorization (SSVC): a decision tree approach that uses exploitation status, exposure and mission impact to reach an action such as track or act, instead of a single number.
- Threat intelligence: reports of active campaigns, public exploit code or ransomware groups using a flaw.
- Exploit availability: public proof of concept code lowers the effort for attackers.
A medium CVSS score with active exploitation can deserve more urgency than a high score that nobody exploits.
Adding business context
| Factor | Question |
|---|---|
| Asset criticality | How important is this system to the business |
| Data sensitivity | Does it hold regulated or confidential data |
| Exposure | Is it reachable from the internet, or deep inside |
| Compensating controls | Is there a firewall rule, segmentation or web application firewall (WAF) protection that limits exploitation |
| Compliance | Does a rule set a deadline |
| Remediation cost and impact | How hard and how disruptive is the fix |
A worked comparison
| Finding | CVSS | Known exploited | Asset | Likely order |
|---|---|---|---|---|
| Remote code flaw on public web server | 9.8 | Yes | Internet facing, customer data | First |
| Same flaw on an isolated test box | 9.8 | Yes | No sensitive data, no outside access | Later |
| Local privilege flaw on payroll server | 7.8 | No | Critical internal | Soon |
| Information leak on a lab device | 4.3 | No | Low value | Scheduled |
The same score gives a different priority because exposure and value differ. Risk is a mix of likelihood (how likely exploitation is) and impact (how bad the result is).
Special cases
A zero day is a flaw with no available fix. The analyst relies on compensating controls such as isolation, access limits and extra monitoring until a patch exists.
What to remember for the exam
- CVSS scores severity from 0.0 to 10.0, and 9.0 or above is Critical in version 3.x.
- The base metrics are attack vector, complexity, privileges, user interaction, scope and the three impact values.
- Base is the intrinsic score, temporal or threat changes over time, and environmental adapts it to your systems.
- EPSS estimates how likely exploitation is, and the KEV catalogue lists flaws known to be exploited.
- Prioritise using CVSS plus threat data, asset value, exposure and compensating controls.
- Internet facing systems with sensitive data usually come first.
- Risk combines likelihood and impact.
- Zero days need compensating controls until a fix exists.
- A KEV listing is a strong reason to raise priority.
If a question gives a lower CVSS score on a critical, exposed asset and a higher score on an isolated lab system, the exposed critical asset usually wins.
Common mistakes
Sorting only by CVSS. A base score ignores whether the flaw is exploited and what the asset is worth.
Treating EPSS as a severity score. It estimates likelihood of exploitation, not the damage.
Ignoring low scores that are exploited. Active exploitation can make a modest flaw urgent.
Forgetting compensating controls. A control that blocks the attack path can legitimately lower the urgency.
Mixing up base and environmental scores. Base is the same for everyone, while environmental is tuned to one organisation.
Check yourself
Which CVSS base metric describes how far away an attacker can be?
Attack vector, which ranges from network to physical.
What does the KEV catalogue list?
Vulnerabilities that are known to be exploited in real attacks.
Why can a lower scored flaw be fixed before a higher scored one?
Exploitation, asset value, exposure or missing compensating controls can make the lower scored flaw the bigger business risk.
Topic 3 of 5 in Vulnerability Management
Test yourself on Vulnerability Management
The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.