Why CVSS Scores Don't Tell the Real Story of Risk
Summary: A Hacker News article argues that CVSS, which was built to standardize technical severity scoring, does not capture context such as whether an asset is internet-facing, how critical it is to the business, or whether attackers are actively exploiting the flaw. The piece describes how findings from pentests, scanners, cloud tools, and identity systems arrive in separate dashboards with their own scoring models, and are often manually re-entered into ticketing systems stripped of screenshots and exploit paths, leaving only severity labels.
Why it matters: The article's own example is a 9.8 flaw in a non-production environment with no external access outranking a 7.2 flaw in a public-facing authentication API supporting millions of users - and attackers, it notes, prioritize reachability and business value rather than severity numbers. If your remediation queue is sorted by score, the count of closed 9.0+ findings may say little about whether exploitable exposure actually went down.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026