FedRAMP Drops CVSS, Adopts Risk‑Based Vulnerability Scoring
FedRAMP will stop using CVSS scores after CISA’s BOD 26‑04, shifting to a risk‑based model that weighs internet exposure, exploit automation, and known‑exploited status. Cloud providers must follow the new Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules by Dec 7 2026.