- CVSS 4.0 retires Scope and replaces it with separate impact metrics for the vulnerable system and subsequent systems. It adds Attack Requirements and splits User Interaction into Passive and Active.
- Always label the score: CVSS-B (base only), CVSS-BT (base and threat), CVSS-BE, or CVSS-BTE. FIRST requires the label wherever a number is shown.
- Base scores describe severity, not risk. Threat and environmental metrics are how you turn a severity into a priority for your organisation.
- Publish the vector with every score, so anyone can check the reasoning.
What changed between CVSS 3.1 and CVSS 4.0?
| Area | CVSS 3.1 | CVSS 4.0 |
|---|---|---|
| Preconditions | Attack Complexity only | Attack Complexity plus new Attack Requirements (AT: None or Present), for conditions like a race window or a specific configuration |
| User interaction | None or Required | None, Passive, or Active |
| Blast radius | Scope (Unchanged or Changed) | Scope retired. Separate C/I/A impact for the Vulnerable System and Subsequent Systems |
| Time-based metrics | Temporal: Exploit Code Maturity, Remediation Level, Report Confidence | Renamed Threat and simplified to Exploit Maturity: Attacked, POC, Unreported, Not Defined |
| Extra context | None | New Supplemental metrics that do not change the score: Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency |
What do CVSS-B, CVSS-BT, CVSS-BE, and CVSS-BTE mean?
CVSS 4.0 makes explicit which metric groups produced a score. CVSS-B uses base metrics only. CVSS-BT adds threat metrics. CVSS-BE adds environmental metrics, and CVSS-BTE uses all three. The label matters because the same vulnerability can legitimately carry very different numbers depending on what is known about exploitation and where it is deployed.
How does a real finding score in 3.1 and 4.0?
Take the example IDOR from our finding format: any signed-in user can download another tenant's invoices by changing an ID.
CVSS 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Base score 7.1 (High)
CVSS 4.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS-B 7.1 (High)
.../E:U (Exploit Maturity: Unreported)
CVSS-BT 5.0 (Medium)The base score is the same in both versions here. The instructive part is the threat metric. With no known exploitation or public proof of concept, the CVSS-BT score drops to 5.0. That is correct for triaging a public CVE across thousands of assets. It is usually the wrong lens for a finding in your own application, which the tester has already exploited. For penetration test findings we report the base vector and score, note that exploitation was demonstrated, and use environmental metrics when the client gives us asset criticality.
Scores above were calculated with the CVSS 4.0 method published by FIRST. Always confirm scores in the official FIRST calculator before publishing them.
How should security teams use CVSS 4.0 in practice?
- Show the vector with every score. A number without a vector cannot be reviewed or challenged.
- Label the metric groups. "7.1 (CVSS-B)" and "5.0 (CVSS-BT)" describe the same bug. Unlabelled, they look like a disagreement.
- Use the Subsequent System metrics deliberately. A flaw in one service that exposes data in another now says so explicitly, instead of hiding it in a Scope change.
- Add environmental context for your own assets. Security requirements and modified base metrics are how a finding on a payments system outranks the same finding on a marketing site.
- Do not rank by score alone. Combine CVSS with exploitation evidence (for example CISA's Known Exploited Vulnerabilities catalog), exposure, and business impact.
Should you switch your reports to CVSS 4.0?
Most tooling and advisories now carry 4.0 vectors, but many compliance frameworks, customer contracts, and internal SLAs still reference 3.1 thresholds. A pragmatic approach is to agree the version in the statement of work, and report both vectors during the transition when stakeholders need it. Our no High or Critical finding guarantee uses CVSS 3.1 base scores by default for this reason, unless the statement of work specifies otherwise.
How we report: every finding from our penetration tests carries a CVSS vector, a score with its version, exploit evidence, and remediation guidance. See what a finding looks like.