Your CVSS 9.8 sits on a jump-host-only admin console and a 6.5 on the payments session path — which is worse?

## The trap in the question Two findings, one Critical and one Medium, and an obvious answer that is usually wrong. The obvious answer is wrong because both numbers were produced by someone who had never seen your architecture. A senior candidate is expected to refuse the comparison as posed and rebuild it. ## Rescoring the 9.8 The admin console is an internal tool. It is not routed from the internet; a user reaches it only from inside a private VLAN, which itself is entered through a jump host. The base vector's network attack vector is not a lie about the software — the flaw genuinely is exploitable over a network — but it is a lie about your deployment. The environmental group exists for exactly this. Set the modified attack vector to Adjacent, which is the setting for a flaw limited to a shared logical or physical network rather than one routable from anywhere. That single change lowers the exploitability contribution and pulls the score down out of the top band. Be precise about what you have and have not claimed. You have not claimed the flaw is harmless. You have claimed that exploiting it requires the attacker to already be inside — an internal foothold, a compromised operator workstation, or a contractor with jump-host access. The asset at stake is administrative credentials, and an attacker who reaches it gains a great deal. So the rescored number stays serious; it just stops being the most urgent thing on the list purely by virtue of a published 9.8. Do not reach for the requirement metrics to express reachability. Confidentiality, integrity and availability requirements say how much the asset matters, not how hard it is to get at. Mixing those two up is the most common rescoring error, and an interviewer listening carefully will catch it. ## Rescoring the 6.5 The other finding is in the session-issuing path of a card-payments switch. Ask what a defect there costs. A forged or replayed session in that path is not a privacy incident, it is unauthorised movement of money, and the same path failing closed stops the switch settling transactions at all. So the confidentiality requirement is high, the integrity requirement is high, and the availability requirement is high — a rare case where all three genuinely are. Requirement metrics default to a neutral middle setting, which is why an unrescored finding is implicitly being treated as sitting on an average asset. Raising all three increases the weight of the matching impact terms, and the environmental score rises **above** the published base. This is the half of environmental scoring that teams forget exists: they reach for it to argue findings down, and never to argue one up. ## The comparison you actually present Bring two rescored vectors and one sentence of context each: | Finding | Published | Assumption replaced | Direction | |---|---|---|---| | Admin console remote code execution | 9.8 | Reachable from anywhere, corrected to reachable from inside the private VLAN only | Down | | Payments session issuance | 6.5 | Average asset, corrected to money with all three requirements high | Up | That table is the deliverable. It converts an argument about intuition into an argument about two named assumptions, each of which someone can dispute on its merits. If a reviewer disagrees that the console is really unreachable — say, because a VPN concentrator terminates onto the same VLAN — the disagreement is about a fact of the network, which is resolvable, rather than about who feels more strongly. ## Traps to avoid **Editing the base vector.** Never rewrite the published base metrics to reflect your network. The base score is a shared reference; if you change it, nobody downstream can reconcile your findings with anyone else's. Corrections belong in the environmental group, which produces a distinct score alongside the untouched original. **Rescoring only downward.** A programme that only ever uses environmental metrics to shrink numbers has turned a rating method into an excuse generator. The payments example is the counterweight, and quoting one of each is the fastest way to show you use the tool honestly. **Guessing the arithmetic.** The metric weights are not intuitive and the formula is not linear. State the direction of each change confidently, then compute. A candidate who confidently asserts an exact rescored number they invented has just demonstrated the failure mode the whole question is about. **Forgetting the timer.** The lowered console score is true only while the console really is unreachable from outside. That adjusted number is a claim about the network's current shape, and it needs re-checking whenever that shape changes.