How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity

This article outlines the changes introduced in CVSS 4.0—including new base metrics, an "attack requirements" field, and finer-grained scoring—and explains how these changes aim to provide more context for exploitation conditions and user interaction. It also discusses how severity scores should be used in vulnerability management, urging administrators to prioritize internet-exposed systems and remote code execution flaws while noting that CVSS scores are imperfect and subject to subjective input.