Attack complexity (AC)

Also written: AC

A CVSS metric that asks whether an attack works every time (L, low) or needs luck or special conditions (H, high). The regreSSHion flaw on office-srv is AC:H, which is one reason it ranks below the firewall.