Monday, May 12, 2025
HomeCVE/vulnerabilityNew Common Vulnerability Scoring System (CVSS) v4.0 Released - What's New!

New Common Vulnerability Scoring System (CVSS) v4.0 Released – What’s New!

Published on

SIEM as a Service

Follow Us on Google News

CVSS (Common Vulnerability Scoring System) is vital for supplier-consumer interaction, offering a numerical score to assess security vulnerabilities’ technical severity that helps in guiding the following entities:-

  • Businesses
  • Service providers
  • Public

CVSS scores interpret the following qualitative ratings for prioritizing vulnerability management and enhancing defense strategies against cyber threats, enabling real-time threat assessment for consumers’ protection:-

  • Low
  • Medium
  • High
  • Critical

At the 35th Annual FIRST Conference in June 2023, the CVSS version 4.0 was unveiled by FIRST. However, after two months of public input and refinement, CVSS version 4.0 was officially released by FIRST.

- Advertisement - Google News

CVSS 4.0 – What’s New?

This new version, CVSS 4.0, aims to offer the most precise vulnerability assessment, as it provides:-

  • Finer detail
  • Clarity
  • Simplification in threat metrics

These are the key elements that make it more effective for assessing security needs and controls. CVSS 4.0 adds new metrics for assessing vulnerabilities, including:-

  • Automatable
  • Recovery
  • Value Density
  • Response Effort
  • Urgency

Moreover, it’s also expanded for the OT/ICS/IoT, with Safety metrics included. CVSS 4.0 is a game-changer for global cybersecurity and incident response teams, offering a vital tool in the face of rising threats.

Diverse rating systems were used for severity before 2005 since, at that time, various non-standard severity systems existed. 

In February 2005, CVSS version 1 was initially introduced, driven by FIRST to standardize vulnerability measurement, which became an important industry tool.

CVSS evolved from version 1 in 2005 to version 3.1 in 2019. Version 4.0 is a notable advance, emphasizing threat intelligence and environmental metrics for more accurate scoring.

Here below, we have mentioned the new nomenclature that has been adopted in version 4.0:-

  • CVSS-B: CVSS Base Score
  • CVSS-BT: CVSS Base + Threat Score
  • CVSS-BE: CVSS Base + Environmental Score
  • CVSS-BTE: CVSS Base + Threat + Environmental Score

The rapid rise in cybersecurity challenges shows the importance of global coordination which is crucial. However, introducing standards like CVSS 4.0 plays a vital role in enhancing internet safety for all.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black...

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear...

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core...