Free CVSS 3.1 calculator. Set Base, Temporal and Environmental metrics for an instant score, severity rating and vector string. Paste a vector to edit it.
This CVSS calculator implements the Common Vulnerability Scoring System version 3.1 exactly as specified by FIRST. Select the eight Base metrics and the score, the severity rating and the vector string update as you go. You can also work backwards: paste an existing vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H from an NVD entry or a vendor advisory and the calculator populates every selector so you can see how the number was reached — and change one metric to see what your environment does to it.
All three metric groups are supported: Base, Temporal and Environmental. The current vector is written into the page URL as you work, so a shared link reproduces the exact scoring for a colleague or a ticket. Note that this is a v3.1 calculator specifically — it does not compute CVSS v4.0 scores, which use a different metric set and a different formula entirely.
Base metrics describe the intrinsic properties of a vulnerability: things that are true regardless of who is affected or when. They split into Exploitability metrics (how hard is it to attack) and Impact metrics (how bad is it when it works), with Scope acting as a hinge between them.
| Metric | Values (numeric) | Question it answers |
|---|---|---|
| Attack Vector (AV) | Network 0.85, Adjacent 0.62, Local 0.55, Physical 0.20 | How far away can the attacker be? |
| Attack Complexity (AC) | Low 0.77, High 0.44 | Do conditions outside the attacker’s control have to line up? |
| Privileges Required (PR) | None 0.85, Low 0.62, High 0.27 | What access must the attacker already hold? |
| User Interaction (UI) | None 0.85, Required 0.62 | Must a human victim do something? |
| Scope (S) | Unchanged, Changed | Does the exploit reach beyond the vulnerable component’s security authority? |
| Confidentiality (C) | High 0.56, Low 0.22, None 0 | How much data is disclosed? |
| Integrity (I) | High 0.56, Low 0.22, None 0 | How much data can be altered? |
| Availability (A) | High 0.56, Low 0.22, None 0 | How badly is service disrupted? |
Scope deserves special attention because it is the metric analysts most often get wrong. Scope is Changed only when exploiting the vulnerable component grants access to resources governed by a different security authority — a hypervisor escape from guest to host, a sandbox break, a stored XSS in a web application that executes in another user’s browser session. When Scope is Changed, the Privileges Required values increase (Low becomes 0.68, High becomes 0.50) because privileges in the vulnerable component matter less when the blast radius extends past it.
The formula is deterministic; the calculator applies it exactly. First the Impact Sub-Score:
ISS = 1 − [ (1 − C) × (1 − I) × (1 − A) ]
Then Impact, which branches on Scope:
Impact = 6.42 × ISSImpact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15Exploitability is a straight product:
Exploitability = 8.22 × AV × AC × PR × UI
And the Base Score combines them, rounding up to one decimal place:
roundup( min( Impact + Exploitability, 10 ) )roundup( min( 1.08 × (Impact + Exploitability), 10 ) )Take an unauthenticated remote code execution flaw: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Now change one metric. Require a low-privileged account and drop integrity and availability impact: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. ISS falls to 0.56, Impact to 3.60, Exploitability to 2.84, and the Base Score lands at 6.5 — Medium. That one-metric sensitivity is why vector strings, not bare numbers, belong in advisories.
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
Base scores never change. Temporal metrics adjust for what is true this week, and all three are multipliers that can only reduce the score:
Temporal = roundup( Base × E × RL × RC ). A 9.8 with a proof-of-concept exploit and an official fix available scores 9.8 × 0.94 × 0.95 × 1.00 = 8.8. The maximum reduction any Temporal combination can achieve is about 21%, which is why Temporal alone rarely moves something out of a remediation SLA band.
Environmental metrics are the group most teams skip and the group that actually makes CVSS useful operationally. They let you restate the vulnerability as it exists in your environment:
AV:N in a component you have placed behind a VPN with no internet exposure can be re-scored MAV:A or MAV:L, which drops the score substantially.This is how a vendor’s Critical 9.8 legitimately becomes a Medium on your risk register — and, just as importantly, how a vendor’s Medium becomes your Critical when the affected system is the one holding regulated data. The calculator computes the Environmental score using the modified metrics together with the security requirements and the Temporal multipliers.
CVSS:3.1/... string into the vector box — from an NVD record, a CVE advisory, a scanner report — and every selector is populated for you.When you have a CVE identifier to score, the CVE lookup tool retrieves the published record, and the CWE lookup resolves the underlying weakness class that the CVE maps to. For a plain-language walkthrough of the model, see what CVSS is and how it is calculated.
No — it implements CVSS v3.1 only, including Base, Temporal and Environmental metrics. CVSS v4.0 introduced a restructured metric set (Base, Threat, Environmental and Supplemental) and a different scoring method, so v3.1 and v4.0 scores are not interchangeable. Most vulnerability data in circulation today, including the bulk of NVD records, is still v3.1.
Almost always because the metric selections differ, not the arithmetic. NVD analysts score conservatively against a generic deployment; vendors score against their own product assumptions. Compare the two vector strings metric by metric — Scope, Privileges Required and Attack Complexity are the usual points of disagreement.
A compact, machine-readable encoding of every metric selection, prefixed with the version: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is the only complete way to communicate a score, because the number alone cannot be audited or re-scored for a different environment.
Only when successful exploitation affects resources beyond the security authority of the vulnerable component. Hypervisor escapes, sandbox breakouts and stored XSS (where the payload runs under another user’s authority) are Changed. A buffer overflow that gives code execution within the same application and the same privilege boundary is Unchanged.
10.0, reached by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — remotely exploitable with no privileges, no user interaction, changed scope and total impact on all three of confidentiality, integrity and availability.
No. CVSS measures technical severity, not risk. A Medium with a widely used exploit on an internet-facing system outranks a Critical in an isolated lab. Use CVSS alongside exploitation evidence (such as CISA KEV) and asset criticality — which is exactly what the Environmental metrics exist to encode.
No. The Base score is immutable and always computed from the eight Base metrics alone. Temporal and Environmental scores are additional figures derived from it, and any metric set to Not Defined contributes a multiplier of 1.0.
The v3.1 specification defines an explicit roundup-to-one-decimal function precisely so that floating-point differences between implementations cannot produce different published scores. A raw result of 9.76 becomes 9.8, and 6.43 becomes 6.5 — and any two spec-compliant calculators agree to the decimal.
It is free with no sign-up. All scoring runs client-side; the only data that ever leaves the page is the vector string you choose to copy or share via the URL.
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the severity of software vulnerabilities. Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a standardized numerical score from 0.0 to 10.0 that reflects the technical severity of a vulnerability, helping organizations prioritize remediation efforts.
CVSS is the de facto standard used by the National Vulnerability Database (NVD), vulnerability scanners like Nessus and Qualys, and compliance frameworks including PCI DSS and FedRAMP. Understanding how CVSS scores are calculated enables security teams to make informed patching decisions rather than treating every vulnerability as equally urgent.
CVSS 3.1 (the current widely-deployed version) calculates scores using three metric groups:
| Metric | Options | Measures |
|---|---|---|
| Attack Vector (AV) | Network, Adjacent, Local, Physical | How the attacker reaches the vulnerability |
| Attack Complexity (AC) | Low, High | Conditions beyond attacker control required for exploitation |
| Privileges Required (PR) | None, Low, High | Authentication level needed |
| User Interaction (UI) | None, Required | Whether a victim must take action |
| Scope (S) | Unchanged, Changed | Whether exploitation impacts resources beyond the vulnerable component |
| Confidentiality (C) | None, Low, High | Impact on information disclosure |
| Integrity (I) | None, Low, High | Impact on data modification |
| Availability (A) | None, Low, High | Impact on system accessibility |
| Score Range | Severity | Typical Response |
|---|---|---|
| 0.0 | None | No action needed |
| 0.1 - 3.9 | Low | Patch in next maintenance window |
| 4.0 - 6.9 | Medium | Patch within 30 days |
| 7.0 - 8.9 | High | Patch within 1-2 weeks |
| 9.0 - 10.0 | Critical | Immediate patching or mitigation |
CVSS (Common Vulnerability Scoring System) is an industry-standard framework for rating the severity of security vulnerabilities. It is important because it provides a consistent way for organizations to prioritize vulnerability remediation efforts based on the potential impact to confidentiality, integrity, and availability of systems.
The Base Score represents the intrinsic characteristics of a vulnerability that remain constant over time. The Temporal Score adjusts the Base Score based on factors that change over time, such as exploit availability and patch status. The Environmental Score further customizes the score based on your specific organizational security requirements and asset importance.
CVSS v3.1 uses five severity ratings: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). These ratings help security teams prioritize which vulnerabilities to address first, with Critical and High vulnerabilities typically requiring immediate attention.
Yes, this calculator generates a shareable URL that includes the complete CVSS vector string. You can copy this URL and share it with colleagues, security teams, or include it in vulnerability reports. The recipient will see the exact same metrics and scores when they open the link.
Attack Vector describes how a vulnerability can be exploited. Network (highest impact) means the attack can be launched remotely, Adjacent requires local network access, Local requires system access, and Physical requires physical device access. A Network attack vector typically results in higher scores because it allows remote exploitation without requiring proximity to the target.
The Scope metric indicates whether exploiting a vulnerability can affect resources beyond the vulnerable component. When Scope is Changed, the vulnerability can impact other components (like escaping a sandbox), which typically increases the overall score. When Unchanged, only the vulnerable component is affected.