How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity

Summary: CVSS 4.0, the new vulnerability scoring model from FIRST, adds an 'attack requirements' field and new base metrics so that vulnerabilities needing non-default configuration score lower, and it puts more focus on IoT and industrial control systems. Cisco Talos' Yves Younan said it could be a year or more before Talos advisories use CVSS 4.0, and the National Vulnerability Database won't adopt it until later this year.
Why it matters: In the first week of 2024 alone, 621 new CVEs were disclosed worldwide, and Younan noted many breaches come from chaining several low-severity vulnerabilities together - so a single 0-10 score, which the reporting researcher and vendor can influence, never tells the whole story of what is exposed on your network.

Read the original at Cisco Talos ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026