https://cveexplained.com/categories/ Recent content in Severity Tiers on CVE Explained Hugo -- gohugo.io en-us 2026 Rietta Inc. All Rights Reserved. https://cveexplained.com/categories/critical/ Mon, 01 Jan 0001 00:00:00 +0000 https://cveexplained.com/categories/critical/ CVSS 9.0–10.0. In Rietta’s practice, a Critical-tier vulnerability is treated as an emergency: patch immediately, out of cycle, especially if the CVE is listed in CISA’s Known Exploited Vulnerabilities catalog. Federal civilian agencies are held to specific, often short remediation deadlines for KEV-listed vulnerabilities under CISA’s Binding Operational Directive 22-01; private-sector organizations aren’t bound by that directive, but treating it as the floor, not the ceiling, is good practice. https://cveexplained.com/categories/high/ Mon, 01 Jan 0001 00:00:00 +0000 https://cveexplained.com/categories/high/ CVSS 7.0–8.9. A High-tier vulnerability generally does not require dropping everything the way a Critical one does, but it does warrant an accelerated patch timeline, typically within days, rather than waiting for the next regular maintenance window. Whether that’s justified depends on exploitability and exposure, which is exactly the judgment call each explainer on this site is written to help with. https://cveexplained.com/categories/medium/ Mon, 01 Jan 0001 00:00:00 +0000 https://cveexplained.com/categories/medium/ CVSS 4.0–6.9. A Medium-tier vulnerability is usually fine to fold into your normal patch cadence rather than an emergency change, unless something about the specific exploit path (public proof-of-concept code, unusual exposure in your own environment) changes that calculus. https://cveexplained.com/categories/low/ Mon, 01 Jan 0001 00:00:00 +0000 https://cveexplained.com/categories/low/ CVSS 0.1–3.9. Low-tier findings are worth tracking in your inventory, but on their own they rarely justify an unscheduled change. We cover a Low-tier CVE here when it’s notable for some other reason: it’s frequently misreported as more severe than it is, or it becomes dangerous only when chained with another issue.