> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/vulnerability-management/cvss-scoring.md).
# CVSS scoring
Prisma Cloud leverages the [CVSS 3.1](https://www.first.org/cvss/v3.1/specification-document) scoring system and normalizes severity ratings into a common schema as the severity terminology can vary between projects. The CVSS framework captures the principal characteristics of a vulnerability and produces a numerical score that reflects the severity of the vulnerability. CVSS scores range from 0.0 to 10.0. The higher the number, the higher the degree of severity.
* For known vulnerabilities with a CVE, Prisma Cloud relies on the most authoritative source.
* For OS packages (packages that are maintained by the OS vendor, marked as type “package” in Compute), the CVE details are from the specific vendor feed.
* For other CVEs, the information is from official sources like NVD and vendor-specific security advisories.
* If the affected package is maintained by an OS vendor, the severity as indicated by the vendor is used and not the severity determined by NVD. Furthermore, for new vulnerabilities missing analysis, or undocumented vulnerabilities (such as PRISMA-IDs), Prisma Cloud uses the severity rating as determined by our threat researchers.
## Mappings
We only normalize vulnerability ratings for the purpose of creating rules. Prisma Console Monitoring section shows the predefined rankings as for Critical, High, Medium severity, and not the vendor defined terminologies.
**Note:** The “unimportant”, “unassigned”, “untriaged”, “negligible” and “not yet assigned” severity reporting name will remain the same as defined by the vendors.
The following table maps popular vendor terminology to Prisma Cloud normalized rankings:
| Vendor terminology | Prisma Cloud score | Vendors |
| ------------------------------------------------------------------------------------ | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Unimportant | Unimportant | \*Debian \*SUSE |
| Unassigned | Unassigned | |
| Negligible | Negligible | Ubuntu |
| Not yet assigned | Not yet assigned | |
| Low | Low | |
| UnTriaged | UnTriaged | Ubuntu |
| Medium | Medium | \*Oracle
\*Red Hat Enterprise Linux \*Rocky \*Suse \*Windows Server
|
| Moderate | Medium | \*Oracle \*Red Hat Enterprise Linux \*Rocky \*Suse \*Windows Server |
| High | High | |
| Important | High | \*Amazon \*Oracle \*Red Hat Enterprise Linux \*Rocky \*SUSE \*Ubuntu |
| Critical | Critical | \*Alpine \* Amazon Linux container image \* Amazon Linux \*BusyBox \*CentOS \*Debian \*Red Hat Enterprise Linux \*SUSE \*Ubuntu (LTS releases only) \*Windows Server \*Chainguard Wolfi Linux |
| end-of-life
Note: 'end-of-life' will be set in the vulnerability status
| Low, Medium, High, or Critical based on NVD. | Debian |
**NOTE:** In the absence of project-specific terminology, Prisma Cloud normalizes using the CVSS base scores defined by NIST. In addition to the numeric CVSS scores, [NVD](https://nvd.nist.gov/cvss.cfm) provides severity rankings of Low, Medium, High, and Critical.
These qualitative grades are simply derived from the numeric CVSS scores:
| CVSS base score | Prisma Cloud severity |
| --------------- | --------------------- |
| 0.0 - 3.9 | Low |
| 4.0 - 6.9 | Medium |
| 7.0 - 8.9 | High |
| 9.0 -10.0 | Critical |
In some cases, the OS vendor’s CVSS scoring and severity rating can differ from NVD’s rating. This is based on the vendor’s analysis of the impact of the CVE specific to their OS and distro, which is the more accurate view of the vulnerability. Prisma Cloud shows the vendor’s rating when reporting findings from workloads running the vendor’s OS, and falls back to NVD’s rating where applicable.
**Example:** [CVE-2021-33574](https://nvd.nist.gov/vuln/detail/CVE-2021-33574) has a CVSS 3.0 score of 9.8 and it’s graded as 'critical' by NVD. The same CVE is graded as 'low' by [Ubuntu](https://ubuntu.com/security/CVE-2021-33574) and 'medium' with a different CVSS score by [Redhat](https://access.redhat.com/security/cve/cve-2021-33574). For workloads running Ubuntu, Prisma Cloud shows Ubuntu’s rating, rather than NVD’s rating.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/admin-guide/vulnerability-management/cvss-scoring.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.