Is CVSS 4.0 scientifically proven?

Not in the sense of an empirical model that predicts the likelihood of abuse or the expected damage. CVSS is a standardized measurement convention based on technical definitions and expert opinions. For version 4.0, millions of possible vectors have been grouped and ranked by experts; FIRST publishes this method in the user manual.

There is testing, but it is limited. NIST examined the CVSS 3 formula against reviews from the designers. That supports the internal operation of that formula, not the prediction of incidents or damage and not automatically version 4.0. Research also finds differences between human raters. CVSS is therefore useful as a transparent, shared measurement method, not as a scientific certainty.