CVSS-BT score

Last updated: Nov 4, 2026

---

Fluid Attacks uses only version 4.0 of the Common Vulnerability Scoring System (CVSS) to score the severity of vulnerabilities. The Fluid Attacks platform does not show or report CVSS v3.1 scores.

CVSS v4.0 has different groups of metrics. The name of a score shows the groups of metrics that it uses:

• CVSS-B: The base metrics
• CVSS-BT: The base metrics and the threat metrics
• CVSS-BE: The base metrics and the environmental metrics
• CVSS-BTE: The base metrics, the threat metrics, and the environmental metrics

Fluid Attacks scores the vulnerabilities with CVSS-BT. Thus, the severity scores in the Fluid Attacks platform use the base metrics and the threat metrics of the vulnerabilities.

For the definitions of all the metrics, read the CVSS v4.0 Specification Document.

Base metrics

The base metrics show the properties of the vulnerability that do not change with time or with the environment. They show how easy the exploitation is and how large the impact is:

• Exploitability metrics: Attack Vector (AV), Attack Complexity (AC), Attack Requirements (AT), Privileges Required (PR), and User Interaction (UI)
• Impact metrics on the vulnerable system: Confidentiality (VC), Integrity (VI), and Availability (VA)
• Impact metrics on the subsequent systems: Confidentiality (SC), Integrity (SI), and Availability (SA)

Threat metrics

The threat metrics show the current threat to the vulnerability. CVSS v4.0 has one threat metric: Exploit Maturity (E). This metric shows the likelihood of attacks against the vulnerability at this time. It has these values:

• Attacked (A): There are reports of attacks against the vulnerability, or there are tools that make the attack easy.
• POC (P): A proof-of-concept exploit is available to the public. There are no reports of attacks or of tools that make the attack easy.
• Unreported (U): There is no known proof-of-concept exploit and there are no known reports of attacks.
• Not Defined (X): There is no data about the threat. The calculation uses the worst condition, the same as "Attacked" (A).

The E metric can make the score lower. It cannot make the score higher than the CVSS-B score.

Example

This vector string has only the base metrics. Its CVSS-B score is 9.3 (Critical):

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

This vector string adds the E metric as "Unreported" (U). Its CVSS-BT score is 8.1 (High):

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

How Fluid Attacks uses the Exploit Maturity metric

• The Fluid Attacks platform marks a vulnerability as exploitable when E is "Attacked" (A) or "Not Defined" (X).
• Fluid Attacks specifies E as "Unreported" (U) for all the vulnerabilities that SCA scans find, also when there are public exploits or reports of attacks. To see if attackers exploit a vulnerability, examine its KEV and EPSS values. For more information, read CVSS score adjustment.

CVSS-BT and CVSSF

The CVSSF metric uses the CVSS-BT score of each vulnerability.