How to read a CVSS score without a security background

A CVSS score tells you how bad a security flaw is in general. It does not tell you how bad it is for you. To decide what to do, read the score, then read 3 parts of the short code next to it, then check 2 things about your own setup.

This post walks through that in 6 steps, using real advisories from this site as examples.

What the number measures

CVSS stands for Common Vulnerability Scoring System. It is published by FIRST, and the version you will see most often is 3.1. A CVSS 3.1 base score runs from 0.0 to 10.0, and the specification groups scores into named bands:

Rating	Score range
None	0.0
Low	0.1 to 3.9
Medium	4.0 to 6.9
High	7.0 to 8.9
Critical	9.0 to 10.0

On this site, the severity word on each advisory follows the CVSS base score the source publishes. Critical is 9.0 and above, High is 7.0 to 8.9, Medium is 4.0 to 6.9, and Low is above 0 and below 4.0. When the source publishes no score, we mark the advisory Info. The methodology page explains this in more detail.

The important limit: the base score describes the flaw itself, not your situation. It is usually set by the product’s maintainer or by a third party scoring on their behalf. The specification expects the people using a product to adjust for their own use of it. In plain terms, you still have to ask whether you run the affected version, whether it can be reached, and how much the system matters to you.

What the vector string tells you

Next to the score you will often see a string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is the vector string. It lists the answers the score was built from. Each pair is a question and a one-letter answer.

• AV, Attack Vector. Where the attacker has to be. N means over a network, including the internet. A means on the same local network. L means they need access to the machine. P means they need to touch the device.
• AC, Attack Complexity. L (Low) means it is straightforward. H (High) means it needs conditions the attacker cannot control.
• PR, Privileges Required. N means no account is needed. L means an ordinary account. H means an administrator account.
• UI, User Interaction. N means no one has to do anything. R means someone has to click or open something.
• S, Scope. U (Unchanged) or C (Changed). Changed means the flaw lets the attacker affect parts beyond the vulnerable component.
• C, I, A. The impact on Confidentiality (can data be read), Integrity (can data be changed) and Availability (can the system be knocked over). Each is H, L or N.

You do not need to memorize all of these. AV, PR and UI answer the most practical question: who could actually use this flaw against you?

Three real examples

Here are 3 advisories from this site, read on 2026-10-27.

Advisory	Product	Score	Vector
SA-26-026	LiteLLM	Critical, 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SA-26-027	LiteLLM	High, 8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SA-26-225	Langflow	High, 8.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SA-26-026 is the worst case. Anyone who can reach it over a network can attack it. It is easy, needs no account and needs no one to click anything, and the impact is high on all 3 counts.

SA-26-027 is identical except for one letter: PR:L. The attacker needs an ordinary account. That one change drops the score from 9.8 to 8.8. If only a few trusted people have accounts on your system, that matters.

SA-26-225 is harder to pull off (AC:H) and needs an account, but the scope changes (S:C), so a successful attack can reach beyond the vulnerable part.

All 3 are also on the CISA Known Exploited Vulnerabilities list, which means attacks have been seen. That is a separate signal from the score, and often a more urgent one. See the CISA KEV glossary entry.

Steps for reading any advisory

1. Read the severity word and the score. Critical and High deserve attention first. Treat the number as a starting point, not a verdict.
2. Read AV. If it says AV:N, the flaw can be attacked over a network. If the affected system faces the internet, move it up your list.
3. Read PR and UI. PR:N means no account is needed. UI:N means no one has to click anything. Both together mean an attacker can act alone.
4. Check whether the advisory is marked known exploited. If it is, assume people are already trying it.
5. Check whether you run an affected version. Compare the advisory’s affected versions with what you have installed, and read its “What to do” section. If you do not run the product or the affected version, you can note it and move on.
6. Decide how fast to act and who acts. For a known exploited, network-reachable flaw in something you run, aim to act within days and name one person to do it. For a lower score that needs an account or a click, schedule it with your normal updates.

What our data shows about versions

Most advisories on this site use CVSS 3.1, but not all. On 2026-10-27, the counts across 727 published advisories were:

Vector version	Advisories
CVSS 3.1	678
CVSS 4.0	35
CVSS 3.0	13
No vector	1

CVSS 4.0 vectors have more parts, but the severity bands are the same, so the steps above still work. Of the 727 advisories, 74 score 9.8 or higher. A high score is common enough that it should not cause panic on its own. Steps 4 and 5 tell you which ones need you this week.

To try this on a live entry, open any page in the advisories list. For the terms, see the CVSS and CVE glossary entries.