SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-cvss-critical-range

On the CVSS qualitative severity scale, which Base Score range is rated Critical?

9.0 to 10.0 is Critical. High is 7.0 to 8.9.

Start playing free

  1. 9.0 to 10.0 ✔
  2. 7.0 to 8.9
  3. 8.0 to 10.0

Why: CVSS maps numeric scores to labels: None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0. Those labels help teams prioritize patches.

Huh, didn't know that: FIRST says using the qualitative severity labels is optional when publishing CVSS scores.

The dad joke
Why did the computer keep sneezing? It had a virus!
Like this card?
Play the game

References

Answer: 9.0 to 10.0. CVSS maps numeric scores to labels: None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9 and Critical 9.0 to 10.0. Those labels help teams prioritize patches.

  1. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    High 7.0 - 8.9 Critical 9.0 - 10.0
    Checked 2026-10-10.
  2. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    The use of these qualitative severity ratings is optional
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyIn CVSS v4.0, which metric group covers characteristics that change over time, such as exploit code becoming available?Security & PrivacyIn CVSS, which Attack Vector value scores highest because the attacker can be anywhere on the internet?Security & PrivacyIn CVSS v4.0, what effect do Supplemental metrics have on the final score?

That's stuff everyone should know.