As one step in Veracode's plan to deprecate CVSS v2, the Vulnerabilities section of the Summary Report that appears in your CLI after an SCA agent-based scan now displays v3 severities, instead of v2. This update is available with SCA agent version 3.8.35 or higher.

The Issues section will display CVSS v2 severities by default, but you can edit the severity in your agent-based scanning rules to reflect v3. If you have not yet modified your rules to use CVSS v3, Veracode recommends setting up organization-level rules to avoid having to edit rules on every workspace individually. Please see attached instructions for more details. Thank you.