CVSS 4.0: what's new and how it impacts vulnerability management
By Kike Gandia · Co-Founder & CEO, OSCP
CVSS 4.0, published by FIRST in November 2023, introduces significant changes compared to CVSS 3.1. New metric groups, clearer naming for score types, and improvements to how security context is assessed. This guide explains what changes with CVSS 4.0 and how to adapt if you're already using CVSS 3.1 in your vulnerability management processes.
What changes in CVSS 4.0 compared to CVSS 3.1
CVSS 4.0 introduces four metric groups: Base (intrinsic to the vulnerability), Threat (equivalent to the former Temporal), Environmental (factors from the user's environment) and Supplemental (additional information not used in the calculation). It also introduces positional naming: CVSS-B (Base), CVSS-BT (Base + Threat), CVSS-BE (Base + Environmental), CVSS-BTE (full). This clarifies which metrics were applied in each score.
Changes to the Base score metrics
CVSS 4.0 distinguishes between the impact on the directly vulnerable system and the impact on downstream systems — a key improvement for vulnerabilities in dependency chains. The User Interaction metric moves from binary (required/not required) to three levels: None, Passive and Active. The "Scope" concept (Changed/Unchanged), which caused confusion in CVSS 3.x, is removed and replaced with downstream system impact metrics.
How to migrate from CVSS 3.1 to CVSS 4.0
There's no direct conversion between CVSS 3.1 and CVSS 4.0 scores — they aren't numerically comparable. A gradual transition is the most practical approach: keep CVSS 3.1 for the existing backlog and adopt CVSS 4.0 for new vulnerabilities. Verify that your vulnerability management platform supports CVSS 4.0 and document which version was used for each assessment to avoid incorrect comparisons.
CVSS 4.0 and EPSS: a more powerful combination
CVSS 4.0 only improves the description of technical severity — it doesn't solve the prioritization problem because it doesn't measure the probability of exploitation. EPSS complements CVSS 4.0 perfectly: use CVSS 4.0 to assess impact, EPSS to assess probability. Together they give you the full picture of real risk.
FAQ
Do NVD and CVEs already use CVSS 4.0?
NVD is in the process of adopting CVSS 4.0. Many CVEs still only carry a CVSS 3.x score in NVD. Vendors are the first to adopt CVSS 4.0 for their own advisories — for example, Cisco, Red Hat and Microsoft already publish some CVSS 4.0 scores in their security advisories.
Should I migrate my SLA policies from CVSS 3.1 to CVSS 4.0 right away?
Not all at once. A gradual transition is the most practical approach. Keep your current CVSS 3.1-based policies for the existing backlog. For new vulnerabilities, adopt CVSS 4.0 and include the CVSS version in your SLA documentation to avoid incorrect comparisons. The full transition can take 12-18 months depending on the size of your inventory.
Does CVSS 4.0 solve the problem of severity false positives?
Partially. CVSS 4.0 offers more refined Environmental metrics that let you better adjust the score to your specific context. But no version of CVSS fully solves the problem, because CVSS remains a severity assessment, not a real risk assessment. Complementing it with EPSS and asset context is still necessary.