CVSS v3.1 vs v4.0: what actually changed

Version 4.0 has been published since November 2023 and almost every Canadian penetration test report still quotes 3.1. That is a defensible choice rather than laziness, but you should know what the two scales disagree about before you put them in the same spreadsheet.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

CVSS v4.0 removed the Scope metric, split impact into two separate sets covering the vulnerable system and any subsequent system, added an Attack Requirements metric, gave User Interaction a third value, and replaced the published arithmetic with a lookup table. The severity bands did not change. A v3.1 score and a v4.0 score for the same flaw are different numbers on different scales, and putting them in one column of a risk register produces a ranking that means nothing.

Which version should a report use?

Ask for v3.1 unless you have a specific reason to want v4.0, and say so in the scope document rather than discovering the answer at the readout. Three reasons it is still the right default in 2026:

1. Your other inputs are v3.1. The National Vulnerability Database, most scanners and most vendor advisories still publish 3.1 vectors, sometimes alongside 4.0 and sometimes not. A report in a version nothing else speaks makes correlation manual.
2. Your contracts probably name it. Severity language in customer security schedules and in remediation policies written before 2024 says "CVSS 3.1" or just "CVSS", and a supplier who switches unilaterally invites an argument about whether a 7.4 is the 7.4 that was agreed.
3. Your auditor does not care which one, only that you use one consistently and meet the timelines attached to it. That is covered under SOC 2 penetration testing and under ISO 27001 penetration testing.

What changed in the base metrics

Scope is the change worth dwelling on, and the metric our CVSS calculator warns about. In 3.1, a scope change applies a 1.08 multiplier and swaps in higher privileges-required weights, so setting it casually moves a score by more than a point. In 4.0 you instead score the subsequent system's confidentiality, integrity and availability directly. It is more work per finding and far harder to get wrong.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

The score is no longer a formula

CVSS v3.1 base scoring is published arithmetic: an impact sub-score, an exploitability sub-score, a minimum, a specified rounding rule. Anyone can implement it in twenty lines, which is why our calculator shows its own sub-scores and why you can check it.

CVSS v4.0 does not work that way. Metric combinations are grouped into equivalence classes, and the score comes from a lookup table of values derived from expert scoring, with interpolation between neighbouring entries. There is no closed-form equation to reimplement. That was a deliberate trade: the 3.1 formula produced orderings its own authors disagreed with, and a table lets the scale match human judgement. The cost is that you cannot derive a 4.0 score with a pen, and you cannot audit the number the way you can audit a 3.1 vector.

CVSS-B, CVSS-BT, CVSS-BTE

Version 4.0 introduced names for how much of the standard you used, and they are worth insisting on in a report.

CVSS-B

Base metrics only. This is what almost every report and every advisory publishes, and it is what people mean when they say "the CVSS score".

CVSS-BT

Base plus Threat. The Threat group replaces 3.1's Temporal group and has been cut to one metric, Exploit Maturity. Remediation Level and Report Confidence are gone, because nobody maintained them.

CVSS-BE and CVSS-BTE

With Environmental metrics, meaning your requirements for confidentiality, integrity and availability plus any modified base metrics. This is the only version that is about your risk rather than the flaw's characteristics, and it is the one nearly nobody computes.

The supplemental group is new and affects no score. It records Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort and Provider Urgency as information for the consumer to act on. Treat it as structured commentary rather than as arithmetic.

Does the same flaw score higher or lower in 4.0?

There is no reliable conversion. Two patterns show up often enough to name. Findings that were scope-unchanged with total impact on one system tend to land in a similar place. Findings where 3.1 forced a scope change to express second-order impact, such as stored cross-site scripting or a container escape, move noticeably. Version 4.0 asks you to state what the subsequent impact was instead of applying a flat multiplier.

Telling the two apart at a glance

The prefix does it. A 3.1 vector begins CVSS:3.1/ and has eight metrics. A 4.0 vector begins CVSS:4.0/, carries eleven base metrics, and contains AT: and VC: which have no 3.1 equivalent. If a report prints a bare number with no vector, ask for it, for either version. A number you cannot check is an opinion with a decimal point. How to press on that is part of reading a penetration test report.

What to write in your scope document

One sentence settles it before testing starts: "Findings will be scored using CVSS v3.1 base metrics, and every finding will carry its full vector string." Add the version to the severity definitions in your remediation policy at the same time. The rest of what belongs in the scope is on how to write a penetration test scope and in the rules of engagement.

Common questions