CVSS v3.1 Calculator
Calculate the Common Vulnerability Scoring System (CVSS) v3.1 base score for any security vulnerability. Select the appropriate metrics for Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Impact (Confidentiality, Integrity, Availability) to determine the severity rating from None (0.0) to Critical (10.0).
What Is CVSS?
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. It provides a standardized way to assess and prioritize vulnerabilities on a scale from 0.0 (None) to 10.0 (Critical).
CVSS is maintained by FIRST.Org, Inc. and is used globally by security teams, vendors, and vulnerability databases like the National Vulnerability Database (NVD).
CVSS v3.1 Metrics
The CVSS Base Score is calculated from eight metrics grouped into two categories:
Exploitability Metrics (How easy is it to attack?)
- Attack Vector (AV): Where can the attacker exploit from? Network (0.85) → Adjacent (0.62) → Local (0.55) → Physical (0.20)
- Attack Complexity (AC): How difficult is the attack? Low (0.77) → High (0.44)
- Privileges Required (PR): Does the attacker need privileges? None (0.85) → Low (0.62/0.68) → High (0.27/0.50)
- User Interaction (UI): Does a user need to interact? None (0.85) → Required (0.62)
Impact Metrics (How much damage can be done?)
- Scope (S): Can the attack affect other systems? Unchanged (U) → Changed (C)
- Confidentiality (C): Can the attacker see secrets? High (0.56) → Low (0.22) → None (0.00)
- Integrity (I): Can the attacker change data? High (0.56) → Low (0.22) → None (0.00)
- Availability (A): Can the attacker disrupt service? High (0.56) → Low (0.22) → None (0.00)
How the Score Is Calculated
The CVSS v3.1 Base Score is derived from two sub-scores: the Exploitability Score and the Impact Score.
Step 1: Exploitability Score
Exploitability = 8.22 × AV × AC × PR × UI
Each metric is a numeric value between 0.20 and 0.85. The product is capped at a maximum of 8.22.
Step 2: Impact Sub-Score (ISS)
ISS = 1 − [(1 − C) × (1 − I) × (1 − A)]
Where C, I, and A are the numeric values for Confidentiality, Integrity, and Availability (0.00 to 0.56).
Step 3: Impact Score
If Scope = Unchanged:
Impact = 6.42 × ISS
If Scope = Changed:
Impact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)15
Step 4: Base Score
If Impact = 0: Base Score = 0
Otherwise:
Base Score = round(0.4 × Exploitability + 0.6 × Impact)
The result is rounded to one decimal place and capped at 10.0.
Severity Ratings
- Critical: 9.0 – 10.0
- High: 7.0 – 8.9
- Medium: 4.0 – 6.9
- Low: 0.1 – 3.9
- None: 0.0
Important Disclaimer
This calculator provides estimates for educational and planning purposes. It implements the CVSS v3.1 Base Score formula. Actual scores may vary based on Temporal and Environmental metrics. Always refer to the official CVSS specification for authoritative scoring.
❓ CVSS Calculator FAQ
What is CVSS?
CVSS (Common Vulnerability Scoring System) is an open framework for assessing the severity of software vulnerabilities on a scale from 0.0 to 10.0.
What is the difference between Base, Temporal, and Environmental scores?
Base Score reflects intrinsic characteristics of the vulnerability (constant over time). Temporal Score adjusts for factors that change over time (exploit availability, patches). Environmental Score customizes the score to a specific organization's environment.
What is the maximum CVSS score?
The maximum CVSS v3.1 Base Score is 10.0 (Critical).
What is a CVSS vector string?
A vector string is a compact textual representation of all metric values used to derive the score, formatted as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How is the Exploitability Score calculated?
Exploitability = 8.22 × AV × AC × PR × UI, where each metric is a numeric value between 0.20 and 0.85.
How is the Impact Score calculated?
First calculate ISS = 1 − [(1−C) × (1−I) × (1−A)]. Then if Scope is Unchanged: Impact = 6.42 × ISS. If Scope is Changed: Impact = 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15.
What is the Scope metric?
Scope indicates whether an exploited vulnerability can affect resources beyond the vulnerable component's security scope. "Unchanged" means it only affects the vulnerable component. "Changed" means it can affect other components.
What is the difference between Low and High impact?
Impact metrics (Confidentiality, Integrity, Availability) use Low (0.22) for limited impact and High (0.56) for complete loss. None (0.00) means no impact.
How do I interpret the severity rating?
Critical (9.0–10.0) requires immediate attention. High (7.0–8.9) is severe. Medium (4.0–6.9) is moderate. Low (0.1–3.9) is minor. None (0.0) means no vulnerability.
Is this calculator free?
Yes, this calculator is completely free to use. No registration or personal data storage is required. All calculations are performed in your browser.