--- title: "CVSS, Common Vulnerability Scoring System | MedTech Terms" description: "An industry-standard 0–10 score that quantifies the severity of a software vulnerability. Plain-English Cybersecurity definition for MedTech teams, with example" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "description": "The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework - currently at version 4.0 (2023) - for assigning a numeric severity score (0.0–10.0) to a software vulnerability. CVSS produces three score types: Base (intrinsic characteristics), Temporal/Threat (how exploitability evolves), and Environmental (impact in a specific deployment). NVD publishes Base scores for every CVE; manufacturers and operators apply Temporal and Environmental adjustments locally.", "url": "https://medtechterms.com/terms/cvss", "termCode": "cvss", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/cvss#article", "headline": "CVSS, Common Vulnerability Scoring System", "description": "An industry-standard 0–10 score that quantifies the severity of a software vulnerability.", "url": "https://medtechterms.com/terms/cvss", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/cvss" }, "about": { "@id": "https://medtechterms.com/terms/cvss#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Common Vulnerability Scoring System, CVSS, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "FIRST CVSS v4.0 Specification", "url": "https://www.first.org/cvss/v4.0/specification-document", "publisher": { "@type": "Organization", "name": "FIRST" } }, { "@type": "CreativeWork", "name": "NIST NVD CVSS Calculator", "url": "https://nvd.nist.gov/vuln-metrics/cvss", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "CISA SSVC", "url": "https://www.cisa.gov/ssvc", "publisher": { "@type": "Organization", "name": "CISA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "url": "https://medtechterms.com/terms/vex" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/patchability#term", "name": "Patchability", "url": "https://medtechterms.com/terms/patchability" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvd#term", "name": "Coordinated Vulnerability Disclosure", "alternateName": "CVD", "url": "https://medtechterms.com/terms/cvd" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Common Vulnerability Scoring System", "item": "https://medtechterms.com/terms/cvss" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/cvss#faq", "mainEntity": [ { "@type": "Question", "name": "CVSS v3.1 or v4.0 - which should we use?", "acceptedAnswer": { "@type": "Answer", "text": "v4.0 was released November 2023 and addresses several v3.1 weaknesses (better coverage of OT/IoT, supply-chain effects, safety impact). NVD now publishes both. Use v4.0 for new assessments; legacy v3.1 scores remain valid." } }, { "@type": "Question", "name": "Should we publish our own CVSS scores?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, when you publish a security advisory for your own product. Vendor-assigned CVSS scores (with Environmental context) are more actionable for operators than NVD's generic Base score." } }, { "@type": "Question", "name": "Is SSVC replacing CVSS?", "acceptedAnswer": { "@type": "Answer", "text": "Not replacing - complementing. CISA's SSVC is a decision-tree triage model that consumes CVSS as one input. Many MedTech teams now report both: CVSS for severity, SSVC for action." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Common Vulnerability Scoring System [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle)CVSS # Common Vulnerability Scoring System An industry-standard 0–10 score that quantifies the severity of a software vulnerability. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework - currently at version 4.0 (2023) - for assigning a numeric severity score (0.0–10.0) to a software vulnerability. CVSS produces three score types: Base (intrinsic characteristics), Temporal/Threat (how exploitability evolves), and Environmental (impact in a specific deployment). NVD publishes Base scores for every [CVE](/terms/cve); manufacturers and operators apply Temporal and Environmental adjustments locally. What the regulation says FDA's 2023 guidance recognizes CVSS as one acceptable severity framework for cybersecurity risk assessment. CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) model is increasingly preferred for triage decisions because it weighs exploitation status and mission impact better than headline CVSS. [AAMI TIR57](/terms/aami-tir57) and the FDA guidance both warn that CVSS alone is insufficient - clinical/safety impact must be added. ## What this means in practice CVSS is most useful as a starting point for triage. Mature MedTech teams take the NVD Base score, apply Environmental modifiers (is the vulnerable code path reachable in our device? is the affected interface exposed?), and combine the result with clinical-harm severity from [ISO 14971](/terms/iso-14971) to make patch-priority decisions. Common pitfalls - • Patching by Base score alone - high-CVSS vulnerabilities in unreachable code waste cycles; low-CVSS vulnerabilities that bridge networks may be urgent. - • Ignoring Environmental metrics - they're the whole point of bringing CVSS into a device-specific risk decision. - • Reporting CVSS scores to operators without your VEX exploitability assessment. ## Frequently asked questions CVSS v3.1 or v4.0 - which should we use? v4.0 was released November 2023 and addresses several v3.1 weaknesses (better coverage of OT/IoT, supply-chain effects, safety impact). NVD now publishes both. Use v4.0 for new assessments; legacy v3.1 scores remain valid. Should we publish our own CVSS scores? Is SSVC replacing CVSS? ## Cross-references ### Used by Things that build on this term. - [ Common Vulnerabilities and Exposures(CVE) ](/terms/cve) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve)[ Cybersecurity Vulnerability Exploitability eXchange(VEX) A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. ](/terms/vex)[ Cybersecurity Coordinated Vulnerability Disclosure(CVD) A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. ](/terms/cvd)[ Cybersecurity Patchability The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner. ](/terms/patchability) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx?from=fda-cybersecurity-101)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity?from=fda-cybersecurity-101)[ Regulatory Refuse to Accept(RTA) FDA administrative decision that a submission is incomplete and won't be substantively reviewed. Adjacent lesson ](/terms/rta?from=fda-cybersecurity-101)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b?from=fda-cybersecurity-101) Cited by Where this term appears across MedTech Terms. Learning paths (1) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 10 of 11 Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 FIRST· 1 NIST· 1 CISA· 1 1. [1 FIRST CVSS v4.0 Specification Verified FIRST · first.org ](https://www.first.org/cvss/v4.0/specification-document) 2. [2 NIST NVD CVSS Calculator Verified NIST · nvd.nist.gov ](https://nvd.nist.gov/vuln-metrics/cvss) 3. [3 CISA SSVC Verified CISA · cisa.gov ](https://www.cisa.gov/ssvc) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym CVSS Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=cvss) Learn in 60 seconds Card Lesson Quiz An industry-standard 0–10 score that quantifies the severity of a software vulnerability. - · CVSS is most useful as a starting point for triage. - · Mature MedTech teams take the NVD Base score, apply Environmental modifiers (is the vulnerable code path reachable in our device? - · is the affected interface exposed?), and combine the result with clinical-harm severity from ISO 14971 to make patch-priority decisions. Remember this Watch out: Patching by Base score alone - high-CVSS vulnerabilities in unreachable code waste cycles; low-CVSS vulnerabilities that bridge networks may be urgent. Related terms - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Vulnerability Exploitability eXchange(VEX) ](/terms/vex) - [Patchability ](/terms/patchability) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Common Weakness Enumeration(CWE) ](/terms/cwe) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) - [NIST Cybersecurity Framework(NIST CSF) ](/terms/nist-csf) - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [STRIDE Threat Model(STRIDE) ](/terms/stride) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)