Does CVSS 4.0 include context?

Version 4.0 includes explicit metric groups for threat, environment, and additional context.

Yes. CVSS 4.0 explicitly includes context. Threat Metrics describe the current maturity of abuse. Environmental Metrics process the concrete deployment environment, including existing security measures, actual accessibility, the required importance of confidentiality, integrity and availability, changed technical characteristics and possible consequences for human safety.

Supplemental Metrics add further context such as safety, recovery, automation, and recovery effort. They do not change the CVSS number, but according to FIRST’s CVSS 4.0 FAQ they can influence the local priority.

A publicly published CVSS-B usually contains only the Base Metrics. That is not the same as saying that CVSS has no context: the customer completes Threat and Environmental Metrics for his own situation and thus receives a CVSS-BTE. FIRST recommends this enrichment for a more meaningful result in your own environment.