CVSS Score Calculator
Turning a Vulnerability Description Into a Single Comparable Number
Not every vulnerability deserves the same urgency. The Common Vulnerability Scoring System (CVSS) breaks a vulnerability down into standardized metrics — how it's reached, how hard it is to exploit, what access it requires, and what it compromises — and combines them into a single 0–10 base score that security teams use to triage patching priority.
The Formula
Impact (Unchanged) = 6.42 × ISC Base
Exploitability = 8.22 × AV × AC × PR × UI
Base Score = Roundup(Impact + Exploitability), capped at 10
This is the official CVSS v3.1 Base Score formula (FIRST.org). Scope "Changed" uses a different impact formula and multiplies the combined score by 1.08; Roundup rounds up to the nearest 0.1 rather than to the nearest value.
Where This Matters
- Patch prioritization — deciding which vulnerabilities in a backlog get fixed first based on a consistent, comparable score.
- Vendor security advisories — CVSS scores are the standard way vendors and CVE databases communicate severity.
- Compliance and SLAs — many patch management policies tie remediation deadlines directly to CVSS severity tiers.
Severity Tiers and Example Scores
| Score range | Severity | Example (this calculator's formula) |
|---|---|---|
| 0.0 | None | — |
| 0.1–3.9 | Low | Local, high complexity, required interaction, low impact = 1.8 |
| 4.0–6.9 | Medium | Network, low complexity, low privileges, no interaction, low confidentiality/integrity impact = 5.4 |
| 7.0–8.9 | High | Network, low complexity, no privileges, no interaction, high confidentiality/integrity impact = 8.1 |
| 9.0–10.0 | Critical | Network, low complexity, no privileges, no interaction, full CIA impact = 9.8 |
Example scores computed by running this calculator's exact CVSS v3.1 formula against the stated metric combinations.
How to Use This Calculator
- Select Attack Vector (AV) — Network, Adjacent, Local, or Physical.
- Select Attack Complexity (AC) — Low or High.
- Select Privileges Required (PR) and User Interaction (UI).
- Select Scope (S) — whether the exploit affects resources beyond its own security scope.
- Select the Confidentiality, Integrity, and Availability impact levels.
- Select Calculate to get the base score and severity rating.
Related Calculations
Once a vulnerability is scored, estimate the financial exposure with the Data Breach Cost Calculator, or check whether affected systems sit behind an adequately sized firewall rule using the Firewall Rule Calculator.