CVSS Calculator
Score a vulnerability with the Common Vulnerability Scoring System, in v3.1 or v4.0. Pick the metrics and the score, severity band and canonical vector string update live — or paste a vector from a CVE advisory to decode it. The maths is the official FIRST.org scoring, run entirely in your browser.
Supports both CVSS 3.1 and 4.0. Decoding fills the selectors below and the score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScoring runs entirely in your browser using the official FIRST.org formulas — CVSS v3.1 implements the specification equations exactly; CVSS v4.0 uses FIRST's official MacroVector lookup and interpolation. Nothing is uploaded.
What this tool is
- A free, in-browser CVSS calculator for both CVSS v3.1 and CVSS v4.0 — pick the metrics and the score, severity and canonical vector string update live.
- CVSS v3.1 implements the official FIRST.org equations exactly (Base, Temporal and Environmental); CVSS v4.0 uses FIRST’s official MacroVector lookup table and interpolation, not an approximation.
- Reverse mode: paste a vector string from a CVE advisory (e.g. CVSS:3.1/AV:N/AC:L/... or CVSS:4.0/AV:N/...) and it decodes to the metrics and recomputes the score.
- A CVSS score runs 0.0–10.0 and maps to None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0).
- Everything is deterministic and client-side — nothing you enter leaves your browser.
How CVSS scoring works
A CVSS score is built from metrics, each a small set of choices. The Base metrics describe the vulnerability itself — how reachable it is and what it damages — and produce the core 0.0–10.0 number. Temporal (v3.1) / Threat (v4.0) metrics adjust for how the real-world threat evolves, and Environmental metrics let you re-score for your own deployment. Here is what each Base metric means:
Base — Exploitability
- AVAttack Vector — How remote the attacker can be: Network, Adjacent, Local, Physical.
- ACAttack Complexity — Whether exploitation needs conditions outside the attacker’s control (Low/High).
- PRPrivileges Required — Privilege level the attacker needs first: None, Low, High.
- UIUser Interaction — Whether a victim must act for the exploit to work (None/Required).
- SScope — Whether impact crosses a security boundary into another component (Unchanged/Changed).
Base — Impact
- CConfidentiality — Loss of data secrecy: High, Low, None.
- IIntegrity — Loss of data trustworthiness: High, Low, None.
- AAvailability — Loss of access to the system/service: High, Low, None.
Temporal & Environmental
- E/RL/RCTemporal — Exploit maturity, remediation level and report confidence — how the score shifts over time.
- CR/IR/ARSecurity Requirements — How much confidentiality/integrity/availability matter in your environment.
- M*Modified Base — Re-state any base metric for your specific deployment (e.g. MAV, MPR, MS).
CVSS v4.0 keeps AV, AC, PR and UI but adds Attack Requirements (AT) and splits impact into Vulnerable System (VC/VI/VA) and Subsequent System (SC/SI/SA), replacing v3.1's single Scope flag.
CVSS severity bands
The qualitative rating is identical across CVSS v3.0, v3.1 and v4.0:
| Severity | Score range |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
CVSS v3.1 vs v4.0
| Aspect | CVSS v3.1 (2019) | CVSS v4.0 (2023) |
|---|---|---|
| Scoring method | Closed-form equations | MacroVector lookup + interpolation (no single formula) |
| Impact metrics | C / I / A on one system | Split: Vulnerable (VC/VI/VA) + Subsequent (SC/SI/SA) |
| Cross-boundary impact | Single Scope flag (S) | Modelled directly via Subsequent System metrics |
| Exploitability | AV, AC, PR, UI | Adds Attack Requirements (AT) |
| Time-based group | Temporal (E/RL/RC) | Threat (E only) |
| Extra metrics | — | Supplemental (Safety, Automatable, Recovery, …) — no score effect |
Worked examples
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HUnauthenticated remote code execution with full impact — the classic "patch now" profile.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReflected XSS: needs a victim click, scope changes into the browser, limited C/I impact.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HMaximum v4.0 vector — full impact on both the vulnerable and subsequent systems.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NLocal low-priv attacker, full impact on the vulnerable system only — no subsequent-system spread.
Scoring source: FIRST.org CVSS (v3.1 Specification Document and the v4.0 specification + reference MacroVector lookup). CVSS is a registered trademark of FIRST.org, Inc. This tool is an independent implementation, not affiliated with FIRST.
Frequently asked questions
What is a CVSS score?
CVSS (Common Vulnerability Scoring System) is the open, vendor-neutral standard maintained by FIRST.org for rating the severity of a software vulnerability. A CVSS score is a number from 0.0 to 10.0 derived from a set of metrics describing how the vulnerability is exploited (attack vector, complexity, privileges, user interaction) and its impact (confidentiality, integrity, availability). The score maps to a qualitative severity: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9) and Critical (9.0-10.0). The exact metric choices are captured in a compact "vector string" so anyone can reproduce the score.
What is the difference between CVSS v3.1 and v4.0?
CVSS v3.1 (2019) scores with closed-form equations over Base, Temporal and Environmental metric groups and a single Scope flag for impact that crosses a security boundary. CVSS v4.0 (2023) is a significant redesign: it splits impact into Vulnerable System (VC/VI/VA) and Subsequent System (SC/SI/SA) metrics, adds Attack Requirements (AT), renames the Temporal group to Threat, adds Supplemental metrics, and — crucially — has no single formula. The v4.0 score is produced by mapping the vector to a MacroVector and looking it up in an official table published by FIRST, then interpolating. This calculator implements both methods exactly as FIRST specifies.
Is this CVSS calculator accurate / official?
The scoring logic mirrors FIRST.org’s own reference implementations. The v3.1 engine reproduces the FIRST specification equations (including the exact "roundup" rule) and matches FIRST’s official calculator across every base-metric combination. The v4.0 engine is a direct port of FIRST’s reference MacroVector algorithm and ships FIRST’s official lookup table, matching the reference calculator on thousands of test vectors. FIRST.org remains the authoritative source for the standard.
How do I read a CVSS vector string?
A vector string is a slash-separated list of metric:value pairs, prefixed with the version — for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Each pair sets one metric: AV:N means Attack Vector = Network, C:H means Confidentiality impact = High, and so on. The vector is the portable, human- and machine-readable record of how a score was reached. Paste one into the "Decode a vector" box above to see each metric selected and the score recomputed.