CVSS v4.0 rates a vulnerability's severity from 0.0 to 10.0. Vendors and bulletin analysts usually publish the Base score; each consumer organization adds Threat and Environmental metrics for its own situation. A score of 9.0 or above is Critical.
Four metric groups
Base metrics capture the intrinsic characteristics of a vulnerability that stay constant over time and across environments. The specification says they are generally set by vulnerability bulletin analysts, product vendors or application vendors.
Threat metrics capture what changes over time, and Environmental metrics capture the user's own setup. The specification says these are specified by consumer organizations. When the NVD publishes only a Base score, each organization running the product must add the rest.
Supplemental metrics add context and have no impact on the calculated score. Scores are labelled by what went in: CVSS-B (Base), CVSS-BT (Base and Threat), CVSS-BE (Base and Environmental) and CVSS-BTE (all three).
Attack Vector and Exploit Maturity
Attack Vector is Network when the system is bound to the network stack and the attacker can be anywhere up to the whole internet. Adjacent limits the attack to a shared local network or limited administrative domain. Local means the system is not bound to the network stack and the attacker uses local access or relies on user interaction. The specification's example of Local is using social engineering to trick a legitimate user into opening a malicious document. Physical needs the attacker to touch the system.
Exploit Maturity, a Threat metric, is Attacked when attacks have been reported or when tools that simplify exploitation, such as exploit toolkits, are publicly or privately available. Proof-of-Concept means public PoC code exists with no reported attacks and no simplifying tools. Unreported means none of those. Not Defined, used when reliable threat intelligence is not available, is scored as Attacked.
Severity ratings
The qualitative scale is None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0. A score of 9.1 is Critical.
Where the exam catches people
Believing an emailed malicious file means Attack Vector Network: the specification scores a flaw that needs a user to open a document as Local.
Believing the vendor or NVD sets Environmental metrics: the specification says consumer organizations specify Threat and Environmental metrics.
Believing Exploit Maturity needs reported attacks to be Attacked: a publicly or privately available exploit toolkit is enough.
Believing Supplemental metrics raise or lower the score: they add context and have no impact on the calculated score.
Believing Not Defined lowers the score: it is treated as Attacked, the worst case.