# CVSS Vector Strings, Explained: How to Read One in a Minute (3.1 and 4.0) > A CVSS vector string -- that CVSS:4.0/AV:N/AC:L/... line in every CISA advisory -- is a compressed scorecard: a version stamp plus a list of facts about the vulnerability, each fact encoded as a two-letter code and a value. Most people paste it into a calculator and read only the number. But the vector is the more useful artifact: it tells you how the flaw is exploited, what breaks when it is, and how bad the worst case is -- in a format you can learn to read directly in about a minute. Here is the anatomy, one 3.1 and one 4.0 vector decoded line by line, what changed between the versions, where the number actually comes from, and the one thing no CVSS score can tell you. - **Published**: 2026-10-27 - **URL**: https://vendorquals.com/blog/cvss-vector-string-explained --- # CVSS Vector Strings, Explained: How to Read One in a Minute (3.1 and 4.0) *A CVSS vector string -- that CVSS:4.0/AV:N/AC:L/... line in every CISA advisory -- is a compressed scorecard: a version stamp plus a list of facts about the vulnerability, each fact encoded as a two-letter code and a value. Most people paste it into a calculator and read only the number. But the vector is the more useful artifact: it tells you how the flaw is exploited, what breaks when it is, and how bad the worst case is -- in a format you can learn to read directly in about a minute. Here is the anatomy, one 3.1 and one 4.0 vector decoded line by line, what changed between the versions, where the number actually comes from, and the one thing no CVSS score can tell you.* ## Key takeaways - **A vector string is a fact list, not a formula.** The format is always the same: a version prefix (CVSS:3.1/ or CVSS:4.0/) followed by `METRIC:value` pairs. Each pair states one fact about the vulnerability. The score is computed from them; the facts are the substance. - **Learn fifteen codes and you can read any advisory.** The codes are stable abbreviations -- AV for how the attack arrives, PR for the privileges it needs, VC/VI/VA for what breaks on the vulnerable system. Values are almost always H, L, and N for High, Low, and None. - **4.0's biggest change is what it measures.** 3.1 asks what happens to "the component." 4.0 splits that in two: the vulnerable system (VC/VI/VA) and the subsequent systems the damage spreads to (SC/SI/SA) -- because the worst attacks cross boundaries. - **The number is the standard's, the risk is yours.** A 9.8 does not mean your environment will be hit; a 5.3 does not mean you can ignore it. CVSS scores severity; your exposure decides risk -- and the last section covers what to do with a decoded vector when it lands. - **Paste, don't parse by eye.** Reading a vector is learnable; computing its score by hand is not -- 4.0 scoring runs on official lookup tables. The [CVSS calculator](/tools/cvss-calculator) decodes any 3.1 or 4.0 vector into plain English and the exact score, in your browser. ## The anatomy, in one glance Take the classic: ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ``` - **`CVSS:3.1`** -- the version. 3.1 and 4.0 are the two you will meet in advisories; 3.0 vectors score identically to 3.1. - **`AV:N`** -- Attack Vector: Network. Exploitable over the network. - **`AC:L`** -- Attack Complexity: Low. Reliable to exploit once you can reach it. - **`PR:N`** -- Privileges Required: None. No account on the target needed. - **`UI:N`** -- User Interaction: None. No human has to click anything. - **`S:U`** -- Scope: Unchanged. The exploit stays inside the component's own boundary. - **`C:H / I:H / A:H`** -- Confidentiality, Integrity, Availability: all High. Total loss of secrecy, of trustworthiness, and of service. That string is the famous 9.8. Notice what you just did: you read a vulnerability's entire profile without computing anything. The codes are the content; the score is a summary of the codes. ## A CVSS 4.0 vector, decoded line by line CISA's ICS and product advisories increasingly carry 4.0 vectors like this one: ``` CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:H/E:P ``` - **`AV:N / AC:L / PR:N / UI:N`** -- same meanings as 3.1: network-reachable, reliable, no privileges, no user action. - **`AT:N`** -- Attack Requirements: None. New in 4.0. The target can be exploited as-is; if this read `AT:P` (Present), the exploit would need the target in a special state first. - **`VC:H / VI:H / VA:L`** -- Vulnerable system Confidentiality, Integrity, Availability. On the system with the flaw: total secrecy and trust loss, degraded but not destroyed service. - **`SC:N / SI:L / SA:H`** -- Subsequent system Confidentiality, Integrity, Availability. New in 4.0, and the version's signature move: what happens *beyond* the vulnerable system. Here: nothing leaves (SC:N), some downstream data can be altered (SI:L), and other systems can be made unusable (SA:H) -- a pattern like a reachable component that can be leveraged to crash or disrupt the services around it. - **`E:P`** -- Exploit Maturity: POC. A proof of concept exists; attacks are not routine yet. Omit it and the standard scores the vector *as if* Attacked -- its own worst-case default. A CISA advisory's vector is the one paragraph worth copying out of the PDF. Paste it -- or any 3.1 or 4.0 vector -- into the [CVSS calculator](/tools/cvss-calculator) and each of these lines comes back as a plain-English sentence plus the exact score. ## What changed from 3.1 to 4.0 | | CVSS 3.1 | CVSS 4.0 | | --- | --- | --- | | What gets measured | One component ("the component") | The vulnerable system and subsequent systems, separately | | Boundary-crossing damage | Approximated through Scope (S:U/S:C) | Modeled directly (SC/SI/SA) | | Preconditions for the exploit | Not captured | Attack Requirements (AT:N/AT:P) | | User interaction | Required or not (UI:N/UI:R) | Passive or Active (UI:N/UI:P/UI:A) | | Physical harm | Not captured in the base metrics | Safety flag on modified metrics; supplemental Safety (S:N/S:P) | | Exploit maturity in the score | Temporal, rarely published | Threat metric (E), omitted by default scored as Attacked | | Scoring math | A formula you can evaluate | A macro-vector lookup, official tables | The practical takeaway: a 3.1 vector and a 4.0 vector are not directly comparable -- same-looking letters, different questions behind them. If a vendor quotes a 3.1 score next to a 4.0 advisory's score, treat the two numbers as different dialects, and read the vectors instead. ## Where the number actually comes from The 3.1 score is a formula: the six exploit-relevant metrics multiply into an exploitability term, the three impact metrics combine into an impact term, and the two are summed under a scope branch and rounded up to one decimal. It is arithmetic -- reproducible with a pocket calculator. The 4.0 score is not a formula in the same sense. The standard groups the metrics into equations, maps each group to a level, and reads the score from official lookup tables keyed by the combined level -- then applies a refinement step against the next-lower combinations. Reproducing it by hand is impractical, which is exactly why calculators exist and why ours runs the specification's own tables -- and is cross-checked against a reference implementation across 5,000 vectors, with every score matched, before we say so. ## What the score does not tell you This is the part that matters after the decoding. A CVSS score -- any version -- measures the severity of the vulnerability in the abstract: how bad the flaw is on a standard scale. It does not measure whether you run the software, whether your exposure matches the attack vector's assumptions, whether your compensating controls break the exploit chain, or whether an attacker would choose you. A network-vector 9.8 on an isolated system is a low risk; a 5.3 on the one internet-facing host in a regulated environment may be your week's priority. So the honest workflow for a decoded vector is: severity from the standard, then risk from your environment -- and then, if the advisory plausibly lands on you, the question that follows is who you would call. The impact shape in the vector answers that: confidentiality-driven exploits (VC:H or 3.1 C:H) are the breach-notification pattern, where [breach counsel](/breach-counsel) and notification deadlines come first; availability-driven or Safety-flagged exploits are the encryption-and-outage pattern, where [OT/ICS-capable responders](/firms/ot-ics-ir) and the [ransomware response guide](/blog/ransomware-negotiation-guide) come first. The calculator routes exactly this way when you paste a vector, and the fuller framework for the whole decision is [how to choose an incident response firm](/blog/how-to-choose-an-incident-response-firm) -- and the five-RFP-myths companion for what to ask the firms you shortlist: [security vendor RFP myths](/blog/security-vendor-rfp-myths). ## Frequently asked questions **What is a good CVSS score?** There is no good score, only bands: 0.0 is None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, and 9.0-10.0 Critical -- the same bands in 3.1 and 4.0. But "good" is the wrong axis: a medium on your crown-jewel system outranks a critical on an isolated one. Read the vector, then apply your context. **What does AV:N/AC:L/PR:N/UI:N mean?** The most common opening in high-scoring vectors: exploitable over the network, reliable to exploit, with no privileges on the target and no user tricked into anything. It is the profile of a worm-class flaw -- which is why those four letters so often front a 9.x. **Is CVSS 4.0 replacing 3.1?** The standard's direction is clear -- 4.0 is FIRST's current version, and advisories increasingly carry it -- but 3.1 vectors remain everywhere in the wild, so most teams need to read both. This guide and the [calculator](/tools/cvss-calculator) treat them as two dialects, not a migration you can wait out. **Why did my 4.0 vector score the same with and without E?** Two likely reasons: the omitted E:X defaults to Attacked, the standard's worst case -- the calculator says so next to the metric -- or your vector's other metrics place it at a level the tables map identically across the exploit-maturity range. The lookup-table structure makes some scores insensitive to E; the tables, not intuition, decide. **Can I compare a 3.1 score with a 4.0 score?** Not directly. The versions measure differently -- 4.0 separates vulnerable-system from subsequent-system damage that 3.1 folds into one component -- so the same flaw can carry different numbers in each version for honest reasons. Compare vectors within one version, or read the metric values side by side. **Do I need cyber insurance context to use CVSS?** No -- the decoding stands alone. But if you carry coverage and an advisory lands, your carrier's panel decides who gets paid, so the responder question runs through the panel: [check what your carrier's panel actually lists](/tools/panel-checker) before the incident does. --- *Everything in this guide reflects the published FIRST CVSS v3.1 and v4.0 specifications (first.org): the metric definitions, value sets, severity bands, the 3.1 formula, and 4.0's macro-vector scoring method. The scoring in our [calculator](/tools/cvss-calculator) is cross-checked against a reference implementation of both specifications on 5,000 generated vectors -- every score matched -- and the tool runs entirely in your browser. We do not rank firms and a CVSS score is not a statement about any firm. Last verified: October 26, 2026. Have a correction or addition? [Request inclusion or a correction ->](/corrections)* Source: https://vendorquals.com/blog/cvss-vector-string-explained. This page is also served as HTML at https://vendorquals.com/blog/cvss-vector-string-explained. --- - [All articles](https://vendorquals.com/blog)