MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesSoftware LifecycleCVSS

    Common Vulnerability Scoring System

    An industry-standard 0–10 score that quantifies the severity of a software vulnerability.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework - currently at version 4.0 (2023) - for assigning a numeric severity score (0.0–10.0) to a software vulnerability. CVSS produces three score types: Base (intrinsic characteristics), Temporal/Threat (how exploitability evolves), and Environmental (impact in a specific deployment). NVD publishes Base scores for every CVE; manufacturers and operators apply Temporal and Environmental adjustments locally.
    What the regulation says
    FDA's 2023 guidance recognizes CVSS as one acceptable severity framework for cybersecurity risk assessment. CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) model is increasingly preferred for triage decisions because it weighs exploitation status and mission impact better than headline CVSS. AAMI TIR57 and the FDA guidance both warn that CVSS alone is insufficient - clinical/safety impact must be added.

    What this means in practice

    CVSS is most useful as a starting point for triage. Mature MedTech teams take the NVD Base score, apply Environmental modifiers (is the vulnerable code path reachable in our device? is the affected interface exposed?), and combine the result with clinical-harm severity from ISO 14971 to make patch-priority decisions.
    Common pitfalls
    • •Patching by Base score alone - high-CVSS vulnerabilities in unreachable code waste cycles; low-CVSS vulnerabilities that bridge networks may be urgent.
    • •Ignoring Environmental metrics - they're the whole point of bringing CVSS into a device-specific risk decision.
    • •Reporting CVSS scores to operators without your VEX exploitability assessment.

    Frequently asked questions

    v4.0 was released November 2023 and addresses several v3.1 weaknesses (better coverage of OT/IoT, supply-chain effects, safety impact). NVD now publishes both. Use v4.0 for new assessments; legacy v3.1 scores remain valid.

    Cross-references

    Used by

    Related terms

    Shared paths + category
    Cybersecurity
    Common Vulnerabilities and Exposures(CVE)

    A globally unique identifier for a publicly disclosed cybersecurity vulnerability.

    FDA Cybersecurity 101 · adjacent
    Cybersecurity
    Vulnerability Exploitability eXchange(VEX)

    A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.

    FDA Cybersecurity 101
    Cybersecurity
    Coordinated Vulnerability Disclosure(CVD)

    A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.

    Same category
    Cybersecurity
    Patchability

    The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner.

    Same category
    Cybersecurity
    CycloneDX

    A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.

    FDA Cybersecurity 101
    Cybersecurity
    Premarket Cybersecurity Submission

    The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

    FDA Cybersecurity 101

    Latest in MedTech

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    FIRST·1NIST·1CISA·1
    1. 1
      FIRST CVSS v4.0 Specification
      Verified
      FIRSTfirst.org
    2. 2
      NIST NVD CVSS Calculator
      Verified
      NISTnvd.nist.gov
    3. 3
      CISA SSVC
      Verified
      CISAcisa.gov

    Inline markers like [1] jump to the matching reference above.