CVSS v4 – A Better Version of an Imperfect Solution

The talk opens with the problem of working through a large backlog of vulnerabilities. CVSS, maintained by FIRST and tied to MITRE's CVE program, has become the common severity scale, and the speaker explains why a newer version was needed. Version 4 separates attack requirements from attack complexity, lets impact be assigned to the vulnerable system or a downstream system, renames the temporal group to threat metrics, and adds a supplemental group. Side-by-side examples, a router ARP spoofing case and a web application code execution case, show how v4 can produce different numbers from v3.1, and the audience's guesses are compared with the results.

The middle section looks at why scores still fall short in practice. Severity is often mistaken for risk, adoption lags among providers and consumers, and many teams rely only on the base group. Limited context pushes people toward worst-case assumptions and score inflation, bug bounty incentives push scores upward, and open source dependencies make it hard to know how a library is really used. Because scoring depends on both providers and consumers, coordination and agreement become problems too.

The closing part suggests practical steps: use the threat and environmental groups, automate threat intelligence and asset data where possible, publish fuller information in advisories, and take part in the CVSS special interest group. The speaker leaves open questions about whether v4 is actually more accurate, and the Q&A covers calculators and how long adoption may take.