CVSS 10 With No Risk

A CVSS score doesn’t always reflect a true risk to your specific application. A vulnerability might have a CVSS score of 10, indicating it is critical, but the actual risk to your application could be negligible, or even zero.

This discrepancy can occur due to several factors specific to your application’s code architecture, configuration, and runtime environment. For example, the vulnerable library or function might exist in your application but is never executed in your specific deployment. Another example, your application’s configuration or customization might render the vulnerable code path inactive.