Attack complexity describes how difficult it is to exploit a vulnerability once an attacker can reach the affected system. In CVSS scoring, high attack complexity means exploitation depends on conditions beyond the attacker’s direct control, such as a particular system configuration, timing, or a precise sequence of events. It does not mean the flaw is harmless, nor does it necessarily require user interaction.
In real attacks, those conditions can make a vulnerability less reliable or limit the systems an attacker can successfully target. Defenders should consider attack complexity alongside other factors, including network reachability and required privileges, rather than treating it as a reason to ignore a flaw. Verify affected software versions, apply available updates, and use vendor guidance to assess whether systems meet the conditions that make exploitation possible.