Is a vulnerability with a CVSS score greater than 4.0 automatically considered failing?

Is a vulnerability with a CVSS score greater than 4.0 automatically considered failing?

• A. True
• B. False
• C. Depends on system criticality
• D. Cannot determine

Answer: (B)

CVSS is a standardized way to gauge how severe a vulnerability is so we can prioritize fixes. But a vulnerability with a score above four isn’t automatically a failure in PCI scanning. Whether it counts as a failure depends on context: is the affected asset in scope, could an attacker reach cardholder data through that vulnerability, and are there compensating controls or an approved risk acceptance in place? If the vulnerability is on an out-of-scope asset, or if there are effective mitigations and it’s not exploitable in the live environment, it may not cause a failure. So, a higher CVSS score signals higher risk and a need for remediation, but it does not automatically fail the assessment.

CVSS is a standardized way to gauge how severe a vulnerability is so we can prioritize fixes. But a vulnerability with a score above four isn’t automatically a failure in PCI scanning. Whether it counts as a failure depends on context: is the affected asset in scope, could an attacker reach cardholder data through that vulnerability, and are there compensating controls or an approved risk acceptance in place? If the vulnerability is on an out-of-scope asset, or if there are effective mitigations and it’s not exploitable in the live environment, it may not cause a failure. So, a higher CVSS score signals higher risk and a need for remediation, but it does not automatically fail the assessment.