CVSS Scoring in Penetration Test Reports

Most findings in a pentest report carry two different numbers that look similar and mean different things: a severity label like "critical" or "medium," and a CVSS score like 9.8. The first is a judgment call. The second is supposed to be arithmetic.

What CVSS actually measures

The Common Vulnerability Scoring System version 3.1 defines a base score from eight metrics: how the flaw is reached (attack vector), how hard it is to pull off (attack complexity), what access the attacker needs first (privileges required), whether a victim has to do something (user interaction), whether the impact stays contained or spreads past the vulnerable component (scope), and how badly confidentiality, integrity, and availability are each affected. Feed those eight choices into FIRST.org's published formula and the same inputs always produce the same score, from any tool, by any tester, anywhere.

Why "critical" and a 9.8 are not the same claim

A severity label is inherently contextual. One team's "critical" might be another's "high," depending on house convention or how conservative the reviewer is feeling that day. A CVSS score is the opposite by design: reproducible and comparable across reports, tools, and vendors, which is exactly why a client tracking findings across multiple engagements or multiple testing firms wants it. Neither number replaces the other. A report that only gives one is giving half the picture.

Who actually asks for it

Auditors reviewing findings against a compliance framework frequently expect a CVSS score specifically, not just a qualitative label, since it is what most vulnerability management platforms ingest to prioritize a remediation queue automatically. If your organization feeds pentest findings into a ticketing system that scores and sorts by CVSS, a report without one means someone has to compute it by hand before the finding is even actionable.

A score is not a priority order by itself

CVSS measures technical severity, not business impact. A 9.8 on a staging server nobody depends on and a 7.2 on the system that processes payments do not deserve the same place in a remediation queue, even though the raw numbers suggest otherwise. Treat CVSS as one structured input into prioritization, alongside what the finding actually touches, never as the whole decision.

For the full picture of how a finding should be documented once it is confirmed, see how to read a pentest report.