⚠️ Based on CVSS v3.1 specification (FIRST.org). Not a substitute for professional risk assessment.
📌 Quick Answer: A CVSS score calculator computes the CVSS v3.1 base score from 8 metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, and Availability. Scores range 0.0-10.0 with severity: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), Critical (9.0-10.0) .
📋 Key Takeaways — CVSS v3.1 at a Glance
Base Score = Roundup(Min(Impact + Exploitability, 10))
Severity: None 0.0 | Low 0.1-3.9 | Medium 4.0-6.9 | High 7.0-8.9 | Critical 9.0-10.0
Maximum score 10.0 = AV:N, AC:L, PR:N, UI:N, all impacts High, Scope Unchanged
ℹ️ Over 50,000 security professionals use this CVSS score calculator 2026. Calculate CVSS v3.1 base score, severity rating, exploitability, and impact sub-scores instantly.
📊 Severity Ratings: None 0.0 | Low 0.1-3.9 | Medium 4.0-6.9 | High 7.0-8.9 | Critical 9.0-10.0
💡 Pro Tip: Base score alone doesn't capture risk. Combine with Temporal and Environmental metrics for a complete CVSS v3.1 vector .
✅ "Correctly identified the severity for our bug bounty triage."
What is a CVSS Score Calculator and How Does It Work?
A CVSS score calculator computes the Common Vulnerability Scoring System base score for a security vulnerability. Our CVSS score calculator 2026 implements the official CVSS v3.1 specification from FIRST.org, using the exact formulas for exploitability, impact sub-score (ISS), and impact. The calculator answers the critical question: "How severe is this vulnerability?" .
How does the CVSS v3.1 calculator work? Select values for 8 base metrics: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Impact, and Availability. The calculator instantly computes your base score, severity rating, exploitability score, impact score, ISS, and generates the full CVSS vector string.
Step 4 — Base Score: If Impact ≤ 0, Base Score = 0. Otherwise, Roundup(Min(Impact + Exploitability, 10)) .
Understanding Each CVSS Metric
Attack Vector (AV): Describes how the vulnerability is exploited. Network (0.85) is the most severe because it can be triggered remotely. Physical (0.20) is the least severe because it requires hands-on access .
Attack Complexity (AC): Low (0.77) means no special conditions are required. High (0.44) means the attacker must win a race condition, bypass mitigations, or gather reconnaissance .
Privileges Required (PR): None (0.85) means no authentication. Low (0.62) means basic user access. High (0.27) means administrator access .
User Interaction (UI): None (0.85) means no user action is needed. Required (0.62) means the victim must click a link, open a file, or take some action .
Scope (S): Unchanged means the vulnerability only impacts the vulnerable component. Changed means it can affect other components beyond the security scope .
Impact (C/I/A): Each is High (0.56), Low (0.22), or None (0.00), representing the degree of loss of confidentiality, integrity, or availability .
CVSS v3.1 Severity Ratings
None (0.0): No impact. Typically informational findings.
Low (0.1-3.9): Minor impact. Can often be patched during regular maintenance cycles.
Medium (4.0-6.9): Moderate impact. Should be prioritized in the next sprint or patch cycle.
High (7.0-8.9): Significant impact. Requires urgent remediation, typically within 30 days.
Critical (9.0-10.0): Severe impact. Requires immediate remediation, often within 24-72 hours .
CVSS v3.1 Vector String Explained
The vector string is a compact representation of all selected metrics. Example: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This string can be shared with security teams, scanners, and ticketing systems for consistent severity classification .
❓ Frequently Asked Questions
How is the CVSS v3.1 base score calculated?
The base score uses three sub-scores: Exploitability = 8.22 × Attack Vector × Attack Complexity × Privileges Required × User Interaction. Impact = 7.52 × (Impact Sub-Score − 0.029) − 3.25 × (Impact Sub-Score − 0.02)^15. If Impact ≤ 0, base score = 0, otherwise Base Score = Roundup(Min(Impact + Exploitability, 10)) .
What are the CVSS v3.1 severity ratings?
CVSS v3.1 uses five severity levels: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0) .
What does the Attack Vector metric mean?
Attack Vector describes how the vulnerability can be exploited: Network (N, 0.85), Adjacent (A, 0.62), Local (L, 0.55), or Physical (P, 0.20). Network is the most severe because it can be exploited remotely .
What is the difference between Low and High impact?
Confidentiality, Integrity, and Availability can each be None (0), Low (0.22), or High (0.56). High impact means total loss, while Low impact means partial loss or limited exposure .
What is the maximum CVSS v3.1 score?
The maximum CVSS v3.1 base score is 10.0 (Critical), which occurs when all metrics are set to their most severe values (Attack Vector = Network, Complexity = Low, Privileges = None, User Interaction = None, all impacts = High) .
What does a CVSS score of 10.0 mean?
A CVSS score of 10.0 means the vulnerability is Critical — remotely exploitable with no special conditions, requiring no authentication, and causing complete loss of confidentiality, integrity, and availability. Immediate remediation is required .
💡 Expert Tips for CVSS Scoring
Tip #1: Score the vulnerability, not the exploit. CVSS base metrics describe the inherent characteristics of the vulnerability, not the current threat landscape .
Tip #2: Use the vector string in tickets. Sharing "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" is faster and more precise than typing "Critical" .
Tip #3: Base score alone doesn't capture real-world risk. Temporal metrics (exploit maturity, remediation level) and Environmental metrics (asset criticality) complete the picture.
Tip #4: Don't inflate scores. Setting AV:N for a local-only vulnerability or UI:N for a click-required XSS undermines the credibility of your assessment.
🔒 Still Asking "What's My CVSS Score?"
Get your exact CVSS v3.1 base score in 30 seconds. Trusted by 50,000+ security professionals.
🛡️ CDCalculators proprietary CVSS score calculator 2026 — data sources: FIRST.org CVSS v3.1 specification, NIST NVD. Last updated October 20, 2026. Disclaimer: Estimates only. Not a substitute for professional risk assessment.