FIRST Announces CVSS v4.0 Public Preview

The Common Vulnerability Scoring System (CVSS) is well known in the world of product security, development and IT. “The Common Vulnerability Scoring System provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity,” per FIRST’s definition.

In layman’s terms, CVSS is used to assign a common score to a discovered vulnerability to let people know, at a glance, how technically severe the vulnerability is and to provide vendors a starting point for assessing the risk of a vulnerability towards their product.

There are a number of scoring systems used across the industry, but CVSS is one of the most prominent and is used by Red Hat and many other organizations. Red Hat has long served as a contributor to the CVSS Special Interest Group (SIG) which is responsible for the creation, updating and support of the standard. The current version of the CVSS standard that is being used is version 3.1.

At FIRST.org’s 35th Annual FIRST Conference in early June 2023, it was announced that CVSS version 4.0 is ready for feedback from a wider audience. Major changes from v3.1 to v4.0 include the introduction of additional supplemental metrics, an increased focus on safety’s effect on a vulnerability, and increased clarity and granularity for many of the existing metrics and overall score. Please view FIRST’s announcement page for a complete list of the changes.

On behalf of the CVSS SIG, we invite all of our partners and associates to test out the new calculator, review the specification documents and submit your feedback! The SIG would greatly appreciate hearing from as many CVSS users as possible so the standard can best reflect the needs of the CVSS community.

Resources for the new standard, including a mock calculator and guidance documentation, can be found on FIRST’s official CVSS v4.0 Public Preview information page.

Additional resources

• FIRST’s website
• FIRST’s CVSS v3.1 Example Calculator
• Red Hat’s Severity Ratings (and description of CVSS)