CVSS 3.1 calculator

The eight base metrics

Four describe how the attack is made. Attack Vector (network, adjacent, local or physical), Attack Complexity (low or high), Privileges Required (none, low or high) and User Interaction (none or required). Scope says whether a successful attack reaches beyond the vulnerable component (changed) or stays inside it (unchanged).

Three describe the damage: the loss of Confidentiality, Integrity and Availability, each None, Low or High. A bug that lets anyone on the internet read every customer record with no login scores very differently from one that needs a local administrator account to read a log file.

How the score is computed

The calculator uses the formula from the FIRST CVSS 3.1 specification. It combines the three impact metrics into an impact sub-score, the four exploitability metrics into an exploitability sub-score, adds them (with a 1.08 multiplier when Scope is changed), caps the result at 10 and rounds up to one decimal. The same formula is behind the scores you see in the National Vulnerability Database.

The vector string is a compact way to write your choices, such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8 Critical. Paste one from a vulnerability report to see how it was scored.

What a score does not tell you

A base score measures the vulnerability in the abstract. It does not know whether the affected software is on your server, whether the flaw is already being exploited, or what the data is worth to you. Use it to compare issues, then decide the order of fixing by what is exposed to the internet and what is already under attack. CISA's Known Exploited Vulnerabilities list is a useful signal for the second question.