Future TechnologyWhat a CVSS 10.0 actually means, and the four questions to ask next
Key takeaways
- A CVSS 10.0 base score describes how bad exploitation would be, not whether anyone is exploiting it right now
- CISA KEV membership matters more than the number, because an actively exploited 7.5 outranks a theoretical 10.0
- Four questions decide your response: do I run it, is it internet reachable, is it in KEV, and is there a patch or only a mitigation
A CVSS 10.0 is the highest score the system can produce, and it appeared twice in the first week of September 2026. Both times, the number did most of the talking and almost none of the explaining.
The score is useful, and narrower than most people assume. Knowing what it does not measure is what turns a headline into a decision.
What the CVSS base score is measuring
The base score in CVSS v3.1 combines eight metrics, and a 10.0 means every one of them landed at the worst end.
Attack vector is network, so the flaw is reachable across the internet rather than needing physical access or a local shell. Attack complexity is low, meaning exploitation does not depend on a race condition or an unusual configuration. Privileges required is none, so the attacker needs no account. User interaction is none, so nobody has to click anything. Scope is changed, meaning the compromised component can reach resources beyond its own security boundary. Confidentiality, integrity and availability impacts are all rated high.
In plain terms: a stranger on the internet, with no credentials and no help from your users, can take the thing over completely and then move sideways.
What the score does not contain is any statement about whether this is happening. It is a severity model, not a threat feed. Plenty of perfect tens are never weaponised, and plenty of mid range scores are being used against real estates today.
The four questions that decide your response
- Do I run the affected product, and which exact version? Version matters more than product name, which is why vendor bulletins are specific about build numbers.
- Is it reachable from the internet, or only from inside my network? A network-vector flaw on an appliance behind a VPN is a different Tuesday than the same flaw on a public storefront.
- Is it in the CISA Known Exploited Vulnerabilities catalog? KEV entries mean confirmed exploitation in the wild, with federal remediation deadlines attached.
- Is there a patch, or only a mitigation? If the answer is a workaround, you need to know how long you will be running it and what it breaks.
Why KEV membership beats the score
If you only track one signal, track KEV rather than CVSS.
A CVSS 7.5 sitting in the KEV catalog is a bigger problem this afternoon than a 10.0 that exists only in a researcher's proof of concept. The score tells you the ceiling of the damage. KEV tells you somebody has already built the ladder.
September 2026 supplied examples of both, alongside the ordinary volume that never makes headlines. CISA added ten exploited flaws in a single stretch, Microsoft addressed 972 CVEs in one Patch Tuesday, and Google patched 180 Android vulnerabilities in the September update.
The part worth sitting with
Most of those numbers will never affect you. The four questions are how you find the ones that will.
If you are auditing older hardware while you are in there, the Windows 11 upgrade checklist for an ageing PC covers the machines that quietly stop receiving these fixes at all. A device that no longer gets patches does not have a CVSS score problem. It has a replacement schedule problem.
