Skip to main content
CVSS v4.0 · FIRST.org · KEV · EPSS · Enrichment Tool

CVSS v4.0
The Practical Field Guide

From a number nobody trusts to a tool that changes how you work. Base scores → Threat enrichment → Environmental context → Prioritized action.

13Chapters
4Worked CVEs
31Infographics
8Common Mistakes
9.0–10.0
Critical
24–72 hours
7.0–8.9
High
30-day SLA
4.0–6.9
Medium
90-day SLA
0.1–3.9
Low
Next cycle

Andrey Pautov

CTI researcher with a strong background in offensive security, vulnerability management, and AI-driven attack simulation. Focused on adversary profiling, detection engineering, and translating vulnerability data into prioritized operational decisions. All scoring examples use publicly available CVE data from NVD, FIRST.org, and CISA KEV.

If this guide saves you time or improves your VM program —

☕ Buy Me a Coffee

Keep the research going

13 chapters, zero fluff

Every chapter is built around a real operational decision — not theory, not vendor marketing.

📖
01

Introduction

Why Base scores are wrong 95% of the time — and what CVSS v4.0 does to fix it.

⚖️
02

v3.1 vs v4.0

Same CVEs, side-by-side. Log4Shell, PrintNightmare, local privesc — see exactly where scores differ and why.

🔬
03

Vector String & Metrics

Full anatomy of the CVSS v4.0 vector string. Every metric explained with practical decision rules.

🔄
04

Scoring Lifecycle

CVSS-B → CVSS-BT → CVSS-BTE. How scores mature from vendor publication to your environment.

🎯
05

Threat & Environmental

KEV, EPSS, Metasploit, ExploitDB. Set E:U vs E:A vs E:P with confidence. Override Base with your reality.

🧪
06

Worked Examples

Log4Shell, Erlang/OTP CVE-2025-32433, 18-Critical firmware report, CitrixBleed, MOVEit, FortiOS.

🏥
07

Industry-Specific Scoring

Healthcare (HIPAA), Finance (PCI-DSS), OT/ICS (ISA/IEC 62443). Environmental profiles per sector.

🗂️
08

CVSS vs SSVC

When CVSS is the right tool and when SSVC gives a better answer. Decision framework for VM programs.

⚙️
09

Practical VM Workflow

End-to-end: scanner output → CVSS-B → CVSS-BT → CVSS-BTE → SLA assignment → ticket.

🛠️
10

Enrichment Tool

Python CLI that pulls KEV, EPSS, NVD, Metasploit, and ExploitDB to auto-enrich CVSS scores.

📋
11

Regulatory Evidence

5-Phase CVSS Maturity Model. Using CVSS-BTE as auditable evidence for NIS2, PCI-DSS, HIPAA, NERC CIP — not CVSS as a framework.

⚠️
12

Common Mistakes & Interview Q&A

The 8 most common CVSS errors — and 6 interview questions that separate practitioners from readers.

📌
13

Cheatsheet & Tools

Quick-reference cards, SLA tiers, all metric values, FIRST.org calculator, KEV API, EPSS API.

Stop sorting by score. Start prioritizing by risk.

The complete CVSS v4.0 workflow — from scanner CSV to enriched, actionable findings.