Simplicalcs

    CVSS calculator

    Attack Vector
    How far away can an attacker be to exploit this? Network = remotely over the internet. Adjacent = must be on the same network. Local = must be logged in. Physical = must physically touch the device.
    Attack Complexity
    Are there special conditions required? Low = anyone can exploit it reliably. High = requires specific configuration, race condition, or additional preparation.
    Privileges Required
    Does the attacker need an account first? None = no account needed. Low = needs a basic user account. High = needs admin or root.
    User Interaction
    Does someone have to click a link or open a file for the attack to work? None = attacker acts alone. Required = needs a victim to take an action.
    Scope
    Does exploiting this vulnerability let the attacker affect other systems or components? Unchanged = impact stays within the vulnerable component. Changed = the attacker can affect something beyond it — like escaping a sandbox.
    Confidentiality Impact
    Can an attacker read data they shouldn't? None = no data exposed. Low = some data exposed, limited impact. High = all or critical data can be read.
    Integrity Impact
    Can an attacker modify data? None = no modification possible. Low = some modification, limited impact. High = critical data can be changed or deleted.
    Availability Impact
    Can an attacker take the system down or make it unusable? None = no availability impact. Low = reduced performance. High = complete loss of availability.
    9.8 Critical
    Exploitability: 3.9 · Impact: 5.9
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    This vector scores 9.8 (Critical) — CVSS's highest severity band, typically remediated as a priority. It requires network access and no privileges, with no user interaction needed to exploit it.

    Advertisement

    How does this CVSS calculator work?

    This tool implements the CVSS 3.1 Base Score — the intrinsic severity of a vulnerability, independent of whether it's actively being exploited or how it affects any one organisation. Pick a value for each of the eight metrics above and the score, severity rating, and vector string update instantly.

    What is CVSS?

    The Common Vulnerability Scoring System (CVSS) is an open, vendor-neutral framework maintained by FIRST.org for rating how severe a security vulnerability is. It's the standard behind the numbers attached to almost every CVE — in NVD entries, vendor advisories, scanner reports, and patch notes — which is what makes it useful for triage: a 9.8 means roughly the same thing regardless of which vendor or scanner produced it.

    What the severity ratings mean

    CVSS 3.1 maps the 0–10 base score onto five qualitative bands: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0). Most vulnerability management processes use these bands to set remediation targets — for example, patching Critical findings within days and Low findings within a quarter — but the underlying 0–10 score is the more precise figure when comparing two vulnerabilities directly.

    How the base score is calculated

    The Base Score combines two sub-scores. Exploitability reflects how easy the vulnerability is to reach and trigger, driven by Attack Vector, Attack Complexity, Privileges Required, and User Interaction. Impact reflects what happens if it's successfully exploited, driven by the Confidentiality, Integrity, and Availability metrics — weighted more heavily when Scope is Changed, meaning the attacker can affect resources beyond the vulnerable component itself. The two sub-scores are combined and rounded up to one decimal place using the official CVSS 3.1 formula.

    What this tool doesn't cover

    This calculator produces the CVSS Base Score only — the intrinsic, environment-independent severity of the vulnerability. CVSS 3.1 also defines optional Temporal metrics (whether a working exploit exists, whether a fix is available) and Environmental metrics (how the vulnerability affects your specific systems), either of which can raise or lower the effective score for your organisation. Neither is calculated here; the Base Score is the right starting point, not the final word on how urgently to act.

    This calculator implements the CVSS v3.1 Base Score exactly as defined by FIRST.org, the standard's maintainer — see the official CVSS v3.1 Specification Document for the full metric definitions and formula.