Towards Improving CVSS
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
In this paper, the authors outline challenges with the Common Vulnerability Scoring System (CVSS) published standard and propose changes to improve it. This paper focuses on common misconceptions and misuses of CVSS. For an alternative system of vulnerability prioritization, see Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization.
The authors have presented a system which overcomes some of these challenges in a new publication, the Stakeholder-specific Vulnerability Categorization: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=653459.
An updated version of "Towards Improving CVSS" has been published in IEEE Security and Privacy as "Time to Change the CVSS?" https://ieeexplore.ieee.org/document/9382369.
Cite This SEI Report
Spring, J., Hatleback, E., Householder, A., Manion, A., & Shick, D. (2018, December 4). Towards Improving CVSS. Retrieved September 12, 2026, from https://www.sei.cmu.edu/library/towards-improving-cvss/.
@techreport{spring_2018,
author={Spring, Jonathan and Hatleback, Eric and Householder, Allen and Manion, Art and Shick, Deana},
title={Towards Improving CVSS},
month={Dec},
year={2018},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/towards-improving-cvss/},
note={Accessed: 2026-Sep-12}
}
Spring, Jonathan, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick. "Towards Improving CVSS." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, December 4, 2018. https://www.sei.cmu.edu/library/towards-improving-cvss/.
J. Spring, E. Hatleback, A. Householder, A. Manion, and D. Shick, "Towards Improving CVSS," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 4-Dec-2018 [Online]. Available: https://www.sei.cmu.edu/library/towards-improving-cvss/. [Accessed: 12-Sep-2026].
Spring, Jonathan, Eric Hatleback, Allen Householder, Art Manion, and Deana Shick. "Towards Improving CVSS." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 4 Dec. 2018. https://www.sei.cmu.edu/library/towards-improving-cvss/. Accessed 12 Sep. 2026.
Spring, Jonathan; Hatleback, Eric; Householder, Allen; Manion, Art; & Shick, Deana. Towards Improving CVSS. Software Engineering Institute. 2018. https://www.sei.cmu.edu/library/towards-improving-cvss/