How to calculate a vulnerability's real impact beyond CVSS

By Kike Gandia · Co-Founder & CEO, OSCP

A vulnerability with a CVSS of 9.8 on an internal server with no internet access can be less urgent than one with a CVSS of 6.5 on your publicly exposed payments API. Base CVSS measures a flaw's intrinsic theoretical severity — regardless of the context in which it appears. To make correct prioritization decisions, you need to go further.

The problem with base CVSS as the only criterion

Base CVSS evaluates a vulnerability in isolation: it assumes the worst-case scenario for the victim's environment. It doesn't consider whether the affected system is exposed to the internet, whether compensating controls are active, whether it processes critical data, or whether the attacker needs prior access to the system.

The result is that a vulnerability list sorted purely by base CVSS correlates poorly with your actual business risk. You might be spending resources patching vulnerabilities on systems no one can reach from outside, while leaving lower-scored flaws unaddressed on exposed, critical systems.

Contextual factors that change the real risk

To calculate a vulnerability's real impact, add these factors to base CVSS:

System exposure: is it exposed to the internet, the internal network, or only to authenticated users? A vulnerability exploitable only from the internet has a very different potential impact than one exploitable only from the internal network.
Data criticality: does the system process personal data (GDPR), financial data (PCI-DSS), health data, or non-sensitive data?
EPSS: are there active exploits for this vulnerability in circulation? A high EPSS score indicates active or imminent exploitation.
Compensating controls: are there a WAF, IDS, network segmentation, rate limiting, or active monitoring that reduce the likelihood or impact of exploitation?
Dependencies: if this system goes down, which other systems are affected?

Environmental CVSS: how to bring context into scoring

CVSS includes Environmental Metrics that let you adjust the base score based on your environment's characteristics. The most relevant ones are:

Confidentiality Requirement (CR): how important is confidentiality of the data on this system? If it's critical, the score goes up.
Integrity Requirement (IR): how important is the integrity of the data?
Availability Requirement (AR): how critical is the system's availability?

You can also adjust the exploitability metrics if compensating controls are active (for example, if the WAF blocks the specific attack vector).

The result is a context-adjusted score that's far more useful for prioritization than pure base CVSS.

A practical framework for assessing real impact in 5 minutes

For every reported vulnerability, answer these five questions:

1. Can an external attacker reach this system? (Exposure)
2. What data can the attacker access by exploiting this? (Data criticality)
3. Is there active exploitation of this type of flaw? (EPSS)
4. Are there controls that make exploitation harder or mitigate it? (Compensating controls)
5. What business impact would this have if exploited today? (Business impact)

With these answers, you can sort the vulnerability into three bands: critical for my environment, important but not urgent, or low real risk regardless of CVSS.

FAQ

Does environmental CVSS change the base score significantly?

It can change it significantly. A vulnerability with a base CVSS of 8.5 on an internal system with non-sensitive data and no internet exposure can drop to 5.0-6.0 once environmental metrics are applied. Conversely, a vulnerability with a base CVSS of 6.0 on a critical system with high-value data can rise to 8.0+.

How do I factor in business context without making scoring subjective?

The key is defining the criteria up front: which systems are critical, which data requires which level of protection, which compensating controls are active. If those criteria are documented, environmental scoring stops being subjective and becomes a reproducible, auditable process.

Can I use EPSS for all vulnerabilities, or only for CVEs?

EPSS only exists for vulnerabilities with an assigned CVE. For business-logic flaws or issues specific to your application that have no CVE, there's no EPSS score available. In those cases, real impact is assessed exclusively using the contextual factors (exposure, data, controls).

Sources

See how we prioritize vulnerabilities in practice