CVSS v3.1 Calculator

Free CVSS 3.1 calculator. Set Base, Temporal and Environmental metrics for an instant score, severity rating and vector string. Paste a vector to edit it.

Advertisement

CVSS v3.1 Calculator: Score a Vulnerability and Get Its Vector String

This CVSS calculator implements the Common Vulnerability Scoring System version 3.1 exactly as specified by FIRST. Select the eight Base metrics and the score, the severity rating and the vector string update as you go. You can also work backwards: paste an existing vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H from an NVD entry or a vendor advisory and the calculator populates every selector so you can see how the number was reached — and change one metric to see what your environment does to it.

All three metric groups are supported: Base, Temporal and Environmental. The current vector is written into the page URL as you work, so a shared link reproduces the exact scoring for a colleague or a ticket. Note that this is a v3.1 calculator specifically — it does not compute CVSS v4.0 scores, which use a different metric set and a different formula entirely.

The Eight Base Metrics

Base metrics describe the intrinsic properties of a vulnerability: things that are true regardless of who is affected or when. They split into Exploitability metrics (how hard is it to attack) and Impact metrics (how bad is it when it works), with Scope acting as a hinge between them.

MetricValues (numeric)Question it answers
Attack Vector (AV)Network 0.85, Adjacent 0.62, Local 0.55, Physical 0.20How far away can the attacker be?
Attack Complexity (AC)Low 0.77, High 0.44Do conditions outside the attacker’s control have to line up?
Privileges Required (PR)None 0.85, Low 0.62, High 0.27What access must the attacker already hold?
User Interaction (UI)None 0.85, Required 0.62Must a human victim do something?
Scope (S)Unchanged, ChangedDoes the exploit reach beyond the vulnerable component’s security authority?
Confidentiality (C)High 0.56, Low 0.22, None 0How much data is disclosed?
Integrity (I)High 0.56, Low 0.22, None 0How much data can be altered?
Availability (A)High 0.56, Low 0.22, None 0How badly is service disrupted?

Scope deserves special attention because it is the metric analysts most often get wrong. Scope is Changed only when exploiting the vulnerable component grants access to resources governed by a different security authority — a hypervisor escape from guest to host, a sandbox break, a stored XSS in a web application that executes in another user’s browser session. When Scope is Changed, the Privileges Required values increase (Low becomes 0.68, High becomes 0.50) because privileges in the vulnerable component matter less when the blast radius extends past it.

How the Base Score Is Calculated

The formula is deterministic; the calculator applies it exactly. First the Impact Sub-Score:

ISS = 1 − [ (1 − C) × (1 − I) × (1 − A) ]

Then Impact, which branches on Scope:

  • Scope Unchanged: Impact = 6.42 × ISS
  • Scope Changed: Impact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15

Exploitability is a straight product:

Exploitability = 8.22 × AV × AC × PR × UI

And the Base Score combines them, rounding up to one decimal place:

  • If Impact ≤ 0, the Base Score is 0.
  • Scope Unchanged: roundup( min( Impact + Exploitability, 10 ) )
  • Scope Changed: roundup( min( 1.08 × (Impact + Exploitability), 10 ) )

Worked Example

Take an unauthenticated remote code execution flaw: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

  • ISS = 1 − (0.44 × 0.44 × 0.44) = 0.9148
  • Impact (Scope Unchanged) = 6.42 × 0.9148 = 5.87
  • Exploitability = 8.22 × 0.85 × 0.77 × 0.85 × 0.85 = 3.89
  • Base = roundup(min(5.87 + 3.89, 10)) = 9.8 — Critical

Now change one metric. Require a low-privileged account and drop integrity and availability impact: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. ISS falls to 0.56, Impact to 3.60, Exploitability to 2.84, and the Base Score lands at 6.5 — Medium. That one-metric sensitivity is why vector strings, not bare numbers, belong in advisories.

Severity Ratings

ScoreRating
0.0None
0.1 – 3.9Low
4.0 – 6.9Medium
7.0 – 8.9High
9.0 – 10.0Critical

Temporal Metrics: Scoring Reality Over Time

Base scores never change. Temporal metrics adjust for what is true this week, and all three are multipliers that can only reduce the score:

  • Exploit Code Maturity (E): Unproven 0.91, Proof-of-Concept 0.94, Functional 0.97, High 1.00.
  • Remediation Level (RL): Official Fix 0.95, Temporary Fix 0.96, Workaround 0.97, Unavailable 1.00.
  • Report Confidence (RC): Unknown 0.92, Reasonable 0.96, Confirmed 1.00.

Temporal = roundup( Base × E × RL × RC ). A 9.8 with a proof-of-concept exploit and an official fix available scores 9.8 × 0.94 × 0.95 × 1.00 = 8.8. The maximum reduction any Temporal combination can achieve is about 21%, which is why Temporal alone rarely moves something out of a remediation SLA band.

Environmental Metrics: Scoring for Your Estate

Environmental metrics are the group most teams skip and the group that actually makes CVSS useful operationally. They let you restate the vulnerability as it exists in your environment:

  • Security Requirements (CR, IR, AR): Low 0.5, Medium 1.0, High 1.5 — how much confidentiality, integrity and availability matter for the affected asset.
  • Modified Base Metrics (MAV, MAC, MPR, MUI, MS, MC, MI, MA): override any Base metric to reflect your deployment. The clearest case: a vulnerability rated AV:N in a component you have placed behind a VPN with no internet exposure can be re-scored MAV:A or MAV:L, which drops the score substantially.

This is how a vendor’s Critical 9.8 legitimately becomes a Medium on your risk register — and, just as importantly, how a vendor’s Medium becomes your Critical when the affected system is the one holding regulated data. The calculator computes the Environmental score using the modified metrics together with the security requirements and the Temporal multipliers.

How to Use This CVSS Calculator

  1. Score from scratch: work through the eight Base metrics in order. The score, severity band and vector string update live; Impact and Exploitability sub-scores are shown separately so you can see which half is driving the result.
  2. Score from an existing vector: paste a CVSS:3.1/... string into the vector box — from an NVD record, a CVE advisory, a scanner report — and every selector is populated for you.
  3. Add Temporal and Environmental metrics by expanding those sections. Metrics left at Not Defined have a multiplier of 1.0 and no effect.
  4. Copy the vector with one click, or share the page URL — the vector travels in the query string, so the recipient sees the identical configuration.

When you have a CVE identifier to score, the CVE lookup tool retrieves the published record, and the CWE lookup resolves the underlying weakness class that the CVE maps to. For a plain-language walkthrough of the model, see what CVSS is and how it is calculated.

Frequently Asked Questions

Does this calculator support CVSS v4.0?

No — it implements CVSS v3.1 only, including Base, Temporal and Environmental metrics. CVSS v4.0 introduced a restructured metric set (Base, Threat, Environmental and Supplemental) and a different scoring method, so v3.1 and v4.0 scores are not interchangeable. Most vulnerability data in circulation today, including the bulk of NVD records, is still v3.1.

Why does my score differ from the NVD score for the same CVE?

Almost always because the metric selections differ, not the arithmetic. NVD analysts score conservatively against a generic deployment; vendors score against their own product assumptions. Compare the two vector strings metric by metric — Scope, Privileges Required and Attack Complexity are the usual points of disagreement.

What is a CVSS vector string?

A compact, machine-readable encoding of every metric selection, prefixed with the version: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is the only complete way to communicate a score, because the number alone cannot be audited or re-scored for a different environment.

When is Scope “Changed”?

Only when successful exploitation affects resources beyond the security authority of the vulnerable component. Hypervisor escapes, sandbox breakouts and stored XSS (where the payload runs under another user’s authority) are Changed. A buffer overflow that gives code execution within the same application and the same privilege boundary is Unchanged.

What is the highest possible CVSS v3.1 score?

10.0, reached by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — remotely exploitable with no privileges, no user interaction, changed scope and total impact on all three of confidentiality, integrity and availability.

Should I patch strictly in CVSS order?

No. CVSS measures technical severity, not risk. A Medium with a widely used exploit on an internet-facing system outranks a Critical in an isolated lab. Use CVSS alongside exploitation evidence (such as CISA KEV) and asset criticality — which is exactly what the Environmental metrics exist to encode.

Do Temporal or Environmental metrics change the Base score?

No. The Base score is immutable and always computed from the eight Base metrics alone. Temporal and Environmental scores are additional figures derived from it, and any metric set to Not Defined contributes a multiplier of 1.0.

Why is CVSS rounding “up” rather than to nearest?

The v3.1 specification defines an explicit roundup-to-one-decimal function precisely so that floating-point differences between implementations cannot produce different published scores. A raw result of 9.76 becomes 9.8, and 6.43 becomes 6.5 — and any two spec-compliant calculators agree to the decimal.

Is the calculator free, and does anything leave my browser?

It is free with no sign-up. All scoring runs client-side; the only data that ever leaves the page is the vector string you choose to copy or share via the URL.

What Is CVSS

The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the severity of software vulnerabilities. Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a standardized numerical score from 0.0 to 10.0 that reflects the technical severity of a vulnerability, helping organizations prioritize remediation efforts.

CVSS is the de facto standard used by the National Vulnerability Database (NVD), vulnerability scanners like Nessus and Qualys, and compliance frameworks including PCI DSS and FedRAMP. Understanding how CVSS scores are calculated enables security teams to make informed patching decisions rather than treating every vulnerability as equally urgent.

How CVSS Scoring Works

CVSS 3.1 (the current widely-deployed version) calculates scores using three metric groups:

Base Score Metrics

MetricOptionsMeasures
Attack Vector (AV)Network, Adjacent, Local, PhysicalHow the attacker reaches the vulnerability
Attack Complexity (AC)Low, HighConditions beyond attacker control required for exploitation
Privileges Required (PR)None, Low, HighAuthentication level needed
User Interaction (UI)None, RequiredWhether a victim must take action
Scope (S)Unchanged, ChangedWhether exploitation impacts resources beyond the vulnerable component
Confidentiality (C)None, Low, HighImpact on information disclosure
Integrity (I)None, Low, HighImpact on data modification
Availability (A)None, Low, HighImpact on system accessibility

Severity Ratings

Score RangeSeverityTypical Response
0.0NoneNo action needed
0.1 - 3.9LowPatch in next maintenance window
4.0 - 6.9MediumPatch within 30 days
7.0 - 8.9HighPatch within 1-2 weeks
9.0 - 10.0CriticalImmediate patching or mitigation

Common Use Cases

  • Vulnerability prioritization: Rank hundreds of scanner findings by CVSS score to focus remediation on the most severe issues first
  • SLA definition: Establish patching timelines tied to CVSS severity levels in your vulnerability management policy
  • Risk communication: Translate technical vulnerability details into a standardized score that non-technical stakeholders can understand
  • Compliance evidence: PCI DSS Requirement 6.1 requires ranking vulnerabilities by risk — CVSS provides the recognized methodology
  • Vendor comparisons: Evaluate the security track record of third-party software by analyzing historical CVSS distributions

Best Practices

  1. Use Environmental metrics for context — The Base Score reflects generic severity. Use the Environmental metric group to adjust scores based on your specific deployment: a network-accessible vulnerability in an air-gapped system is less critical than the base score suggests.
  2. Don't ignore Medium-severity findings — Organizations that only patch Critical and High CVEs accumulate a growing attack surface of exploitable Medium vulnerabilities. Address these within defined SLAs.
  3. Combine CVSS with exploit intelligence — A CVSS 7.5 vulnerability with a public Metasploit module poses more immediate risk than a CVSS 9.0 with no known exploit. Cross-reference with CISA KEV, Exploit-DB, and threat intelligence feeds.
  4. Understand CVSS 4.0 changes — CVSS 4.0 introduces granular attack requirements, updated environmental metrics, and supplemental metrics for automatable attacks and recovery. Plan your transition from 3.1 to 4.0.
  5. Document your scoring rationale — When you adjust scores using Temporal or Environmental metrics, record why. Auditors and future analysts need to understand your risk acceptance decisions.

Frequently Asked Questions

What is CVSS and why is it important?+

CVSS (Common Vulnerability Scoring System) is an industry-standard framework for rating the severity of security vulnerabilities. It is important because it provides a consistent way for organizations to prioritize vulnerability remediation efforts based on the potential impact to confidentiality, integrity, and availability of systems.

What is the difference between Base, Temporal, and Environmental scores?+

The Base Score represents the intrinsic characteristics of a vulnerability that remain constant over time. The Temporal Score adjusts the Base Score based on factors that change over time, such as exploit availability and patch status. The Environmental Score further customizes the score based on your specific organizational security requirements and asset importance.

What do the CVSS severity ratings mean?+

CVSS v3.1 uses five severity ratings: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). These ratings help security teams prioritize which vulnerabilities to address first, with Critical and High vulnerabilities typically requiring immediate attention.

Can I share my CVSS calculation with others?+

Yes, this calculator generates a shareable URL that includes the complete CVSS vector string. You can copy this URL and share it with colleagues, security teams, or include it in vulnerability reports. The recipient will see the exact same metrics and scores when they open the link.

What is the Attack Vector metric and how does it affect the score?+

Attack Vector describes how a vulnerability can be exploited. Network (highest impact) means the attack can be launched remotely, Adjacent requires local network access, Local requires system access, and Physical requires physical device access. A Network attack vector typically results in higher scores because it allows remote exploitation without requiring proximity to the target.

How does the Scope metric impact the CVSS score?+

The Scope metric indicates whether exploiting a vulnerability can affect resources beyond the vulnerable component. When Scope is Changed, the vulnerability can impact other components (like escaping a sandbox), which typically increases the overall score. When Unchanged, only the vulnerable component is affected.

This tool is provided for informational and educational purposes only. All processing happens in your browser — no data is sent to or stored on our servers. While we strive for accuracy, we make no warranties about the completeness or reliability of results.