EOL Risk Score vs CVSS: What Each One Measures
CVSS rates one vulnerability: how severe a specific flaw is, from 0.0 to 10.0. The EOL Risk Score rates one software version: how risky it is to keep running, from 0 to 100, based on its lifecycle state. They answer different questions and do not compete. CVSS tells you how bad a known flaw is. The EOL Risk Score tells you whether the software that flaw lives in is still being fixed by its vendor, and how exposed it is if not.
Side by side
| CVSS | EOL Risk Score | |
|---|---|---|
| What is scored | One vulnerability (a CVE) | One version of one software product |
| Question it answers | How severe is this flaw? | How risky is it to keep running this version? |
| Scale | 0.0 to 10.0 | 0 to 100 |
| Bands | None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0 | Low 0 to 25, Medium 26 to 50, High 51 to 75, Critical 76 to 100 |
| Inputs | Four metric groups: Base, Threat, Environmental and Supplemental | Four factors: end-of-life recency (40 points), attack surface (30), CISA KEV exposure (20), extended support availability (10) |
| Knows whether the version is still supported | No | Yes, it is the largest factor |
| Knows whether a fix will ever exist | No | Indirectly: past end of life, the vendor has said no more fixes |
| Covers flaws not yet discovered | No, a score needs a CVE | Yes, in the sense that it rates the state the next flaw will land in |
| Changes over time | Base score is fixed; Threat and Environmental values can be updated by the consumer | Recalculated at every build as dates pass and the KEV catalog changes |
| Who publishes it | FIRST maintains the framework; scores are assigned by CVE numbering authorities and the NVD | endoflife.ai, with the method public |
CVSS details are from FIRST's CVSS v4.0 specification. The EOL Risk Score method is on the Risk Score page.
What CVSS is
The Common Vulnerability Scoring System is an open framework maintained by FIRST, the Forum of Incident Response and Security Teams, for describing the characteristics and severity of software vulnerabilities. The Base metrics capture the qualities of a flaw that do not change: how an attacker reaches it, what it requires, and what it does to confidentiality, integrity and availability. Threat and Environmental metrics let the consumer adjust for exploit maturity and for their own environment. FIRST's specification is explicit that consumers should enrich the Base score with those values to get a useful input to their own risk assessment; the Base score on its own is a severity rating.
What the EOL Risk Score is
The EOL Risk Score is endoflife.ai's rating of a software version's lifecycle risk. It does not look at individual CVEs. It looks at the state of the version: how long ago vendor fixes stopped, how exposed that kind of software usually is, whether the product has a history of exploitation in CISA's Known Exploited Vulnerabilities catalog, and whether paid extended support exists as a bridge. Every version of every tracked product has a score page showing the number and the four factors behind it, for example PHP 7.4 at 90 and Node.js 18 at 65.
How to use them together
- Use the EOL Risk Score to find the versions the vendor no longer patches. Start with the inventory question: which of our versions are past end of life, and which are closest to it? Those are the systems where a future CVE stays open unless extended support covers it.
- Use CVSS, with EPSS and the KEV catalog, to rank the known flaws on supported software. There a fix exists, and the question is order. Our EPSS comparison covers that side.
- Treat an end-of-life version as a finding in its own right. Vulnerability scanners are built around CVEs. Some also flag unsupported versions of widely deployed products, but coverage varies by product and tool, so a scan with no critical findings does not establish that the software is still supported. Record end of life in the risk register with its own owner and date.
- Where the two meet, act first. An exploited CVE on a version past end of life has no vendor fix coming for that version. Our Exploited and Unpatchable feed lists exactly those cases.
Frequently Asked Questions
What is the difference between the EOL Risk Score and CVSS?
CVSS rates one vulnerability: how severe a specific flaw is, on a scale of 0.0 to 10.0. The EOL Risk Score rates one software version: how risky it is to keep running, on a scale of 0 to 100, based on how long ago it reached end of life, its attack surface, whether the product appears in CISA's Known Exploited Vulnerabilities catalog, and whether extended support exists. One describes a flaw, the other describes the state of the software the flaw lives in.
Does CVSS tell you whether software is end of life?
No. CVSS metrics describe a vulnerability: how it is reached, what it needs and what it affects. No CVSS metric records whether the affected version is still supported or whether a fix will ever be issued for it.
Does the EOL Risk Score replace CVSS?
No. They are used together. CVSS, EPSS and the KEV catalog help rank known vulnerabilities. The EOL Risk Score ranks software versions by lifecycle risk, including versions that will receive no vendor fixes for vulnerabilities not yet found.
Who publishes each score?
CVSS is an open framework maintained by FIRST, the Forum of Incident Response and Security Teams. The EOL Risk Score is published by endoflife.ai, with its method public on the Risk Score page.