CVSS score adjustment

Last updated: Oct 26, 2026

Software composition analysis (SCA) detects when open-source components and dependencies in your software project have related CVE entries. An attacker can exploit these vulnerabilities only in special conditions. Your application possibly does not have them.

To show their possible impact accurately, Fluid Attacks adjusts the CVSS score of vulnerabilities found with SCA scans. Fluid Attacks gets the original CVSS score (v3.1 and 4.0) and specifies that the scan cannot prove that the vulnerability is exploitable. Fluid Attacks also specifies the Remediation Level and Report Confidence values (only in v3.1). The CVE-reporting source possibly does not specify these values.

Fluid Attacks specifies these values:

Exploit Code Maturity/Exploit Maturity (E) as "Unproven" (U)
Remediation Level (RL) as "Official Fix" (O) (only in v3.1)
Report Confidence (RC) as "Confirmed" (C) (only in v3.1)

Because of these values, the CVSS scores that Fluid Attacks' SCA reports are lower than the scores that the CVE-reporting sources calculate.

This example shows a vulnerability that Fluid Attacks' SCA reported. The example compares only CVSS v3.1 scores, because the CVE-reporting sources frequently do not calculate the v4.0 scores at this time.

See vulnerability found by the Fluid Attacks SCA

Click the location of the vulnerability. The Details tab shows the CVE.
Go to the Severity tab. This tab shows the CVSS vector string that Fluid Attacks assigned (CVSS v3.1 score: 8.5).
Examine the advisory of NIST and the responsible CNA. The advisory shows the CVSS vector string that they assigned (CVSS v3.1 score: 9.8).
Compare the two v3.1 vector strings. Fluid Attacks specified E, RL and RC. These values make the CVSS score calculation more accurate.

Source: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fluid Attacks: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

The result is an important difference of 1.3 units. In the qualitative severity rating, the difference is one level.

In this case, the CVSS v4.0 vector string calculated by Fluid Attacks, specifying E as noted, is the following and equals a score of 8.1, lower than that obtained with v3.1: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

If Fluid Attacks' pentesting team performs a review of a vulnerability reported by SCA scans and can prove that the vulnerability is exploitable, the CVSS score is adjusted to reflect this.