Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models

Key points

• Now, NIST enriches only the high priority CVEs, leaving many newly published vulnerabilities unlabelled with the classifiers that security teams use for patch triage.1
• In CVE enrichment, we predict the eight base components of CVSS v3.1 vector, base score, severity tier, and CWE from the vulnerability's textual description alone.1
• To prevent leakage between near-duplicate descriptions, all systems are trained only on CVEs published in 2022 and 2023.1
• A fine-tuned 3.8B-parameter model Phi-3.5-mini, trained with LoRA in 2.5 hours on a single Apple M5 Pro chip, achieves 69.9% accuracy on severity and 70.9% on CWE.1

Sources (1)

• [1]Predicting CVSS and CWE from CVE Descriptions with Fine-Tuned Small Language Models
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 16, 10:46 PM

  Until April 2026, the National Vulnerability Database labeled nearly every published Common Vulnerabilities and Exposures (CVE) entry with a Common Vulnerability Scoring System (CVSS) v3.1 vector, a severity tier, and a Common Weakness Enumeration (CWE) weakness type.

  Now, NIST enriches only the high priority CVEs, leaving many newly published vulnerabilities unlabelled with the classifiers that security teams use for patch triage.

Extractive summary: sentences quoted from the sources.