In the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?

A range of 4.0–6.0 is too narrow and does not match the official CVSS v3.1 specification, which extends the Medium range up to 6.9, not 6.0.

A range of 3.9–6.9 is incorrect because 3.9 falls within the Low severity band (0.1–3.9), not the Medium band, making the lower boundary wrong.

A range of 3.0–6.9 is incorrect because scores from 3.0 to 3.9 belong to the Low severity category, so the lower boundary is set too low for Medium severity.

According to the official CVSS v3.1 specification, Medium severity is defined as a base score ranging from 4.0 to 6.9 inclusive. This range sits between Low (2.0–3.9) and High (7.0–8.9), and is part of the five-tier rating system: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0).