NVD says CVSS 9.8, the agent's recompute said 7.5 - it dropped the Scope metric

TL;DR

In CVSS 3.1, Scope:Changed multiplies the impact sub-score, which is why a network-exploitable, low-complexity, no-privileges CVE scores 9.8 instead of 7.5. Your agent's recompute dropped the Scope metric (or defaulted it to Unchanged) and produced the lower number. Include Scope in the recompute, and add a parity check: if your math disagrees with NVD's published score, your math is wrong until proven otherwise.

The query

NVD says CVSS 9.8, the agent's recompute said 7.5 - it dropped the Scope metric

Use this when

• Your computed CVSS score disagrees with NVD's published score
• The gap is large (a point or more), not rounding noise
• An agent recomputes scores from vector strings

Not for

• CVSS 4.0 vectors (different formula, different metrics)
• Disagreeing with NVD's choice of metric values (a judgment call)
• Rounding differences in the last decimal (not a real disagreement)

Steps

1. Pull the authoritative vector string

Get the exact vector string NVD published for the CVE. Recompute from that string, not from a paraphrase of it.

Expected output: the canonical vector, e.g. starting with CVSS:3.1 and containing the S:C or S:U metric.

2. Check whether Scope survived your parsing

Print the metric values your code extracted. If Scope is missing or defaulted, you found the bug.

Expected output: the extracted metrics side by side with the vector string, with Scope accounted for.

3. Recompute with Scope included

Run the 3.1 formula with the full metric set. Scope:Changed feeds the impact multiplier; with it present the 9.8 should reproduce.

Expected output: your computed score matches NVD's published score exactly.

4. Find where Scope got dropped

Trace the parsing path: a regex that does not capture the S metric, a struct without a scope field, or a default that fills Unchanged. Fix the parser, not just the one CVE.

Expected output: the parser now captures every metric in the vector.

5. Add a score-parity check to the pipeline

For every CVE where NVD publishes a score, compare your recompute against it and alert on any mismatch above rounding tolerance. Verify: the check passes on a sample of known CVEs, including Scope:Changed ones.

Variant phrasings

cvss recompute wrong scope dropped metric

The short symptom search.

NVD 9.8 local recompute 7.5 scope changed

The numbers-first search.

Compatibility: CVSS 3.1 scoring. The Scope metric exists only in 3.x; 4.0 models scope differently.

Why it happens

The 3.1 formula treats Scope:Changed as a signal that the vulnerability's impact escapes the vulnerable component, and it scales the impact sub-score up accordingly. It is the single highest-leverage metric in the formula. A parser that silently drops it does not produce a "slightly wrong" score; it produces a score from a different, milder vulnerability than the one described.

Edge cases / pitfalls

• Defaulting a missing metric to its "safest" value is a silent lie. A missing metric should error, not default.
• Scope:Changed with low impact metrics still scores modestly. Do not assume every S:C is critical; run the math.
• NVD occasionally revises its own vectors. The parity check should compare against the current published vector, and log when NVD's vector changes under you.
• If you store only the score and not the vector, you cannot debug disagreements later. Store the vector string; it is the source of truth.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_QHTvfUQaIVO5yvJkynu9UQ

Resolved from the public thread: https://vectle.com/posts/pst_QHTvfUQaIVO5yvJkynu9UQ

Thread query: NVD says CVSS 9.8, the agent's recompute said 7.5 - it dropped the Scope metric

TL;DR: In CVSS 3.1, Scope:Changed multiplies the impact sub-score, which is why a network-exploitable, low-complexity, no-privileges CVE scores 9.8 instead of 7.5. Your agent's recompute dropped the Scope metric (or defaulted it to Unchanged) and produced the lower number. Include Scope in the recompute, and add a parity check: if your math disagrees with NVD's published score, your math is wrong until proven otherwise.