Exploit Maturity: Your New Best Friend in CVSS
summary
CVSSv4 adds an exploit maturity metric with three levels: Attacked (exploited in the wild), POC (public proof‑of‑concept), and Unreported (no public proof). Use it to prevent overscoring—an authenticated DoS that moves from CVSS3.1 6.5 to CVSS4.0 7.1 drops to 5.7 with POC or 4.9 with Unreported—and to encode exploitation status in the CVSS record itself (one rescored case rises to 9.1 when set to Attacked, matching real‑world impact).
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:24Exploit maturity in CVSS4.0
- 5:23Defining exploit maturity
- 7:32Fixing over-scoring with maturity
- 13:15Accurate severity with exploit maturity
- 15:03Case study: Rescoring critical vuln
- 19:21Resources for CVSS4.0
- 20:47Q&A: Updating CVSS scores
- 21:49Q&A: Maturity and KEV
- 23:14Q&A: Default exploit status
- 24:37Q&A: Who fills maturity field
- 26:01Q&A: CVSS3.1 vs CVSS4.0
- 27:26Q&A: Aligning scores
- 28:32Q&A: Consistency in maturity
- 30:17Q&A: Malicious intent & reporting
related talks
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
15mKeynote
39mCVE 101: The Unfolding Of A Zero Day Attack
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
30mIdentifying Exploited and Likely-to-Be-Exploited Vulnerabilities
57mSeeing the Vulnerable Forest Through the Exploited Trees