SESK: Stuff Everyone Should Know · sesk.info/secplus-cvss-supplemental-no-score
In CVSS v4.0, what effect do Supplemental metrics have on the final score?
None. They add context but do not change the score.
- None, they only add context ✔
- They raise the score by up to 1 point
- They replace the Base score
Why: Supplemental metrics, such as Safety and Automatable, give extra insight about a vulnerability. Each consumer can decide how much weight to give them. They never change the numeric result.
Huh, didn't know that: FIRST says the CVSS vector string should be displayed along with the vulnerability score.
Supplemental metrics are like sprinkles: nice to have and they don't change the cake's weight.
Like this card?
References
Answer: None, they only add context. Supplemental metrics, such as Safety and Automatable, give extra insight about a vulnerability. Each consumer can decide how much weight to give them. They never change the numeric result.
- FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
Supplemental metrics do not modify the final score
Checked 2026-10-10. - FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
should be displayed with the vulnerability score
Checked 2026-10-10.
Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.
More stuff everyone should know
Security & PrivacyOn the CVSS qualitative severity scale, which Base Score range is rated Critical?Security & PrivacyIn CVSS v4.0, which metric group covers characteristics that change over time, such as exploit code becoming available?Security & PrivacyIn CVSS, which Attack Vector value scores highest because the attacker can be anywhere on the internet?
That's stuff everyone should know.