CVE Severity Calculator

Adjusted = min(10, base × exposure × sensitivity × threatMultiplier × (1 − controlReduction)), where threatMultiplier = 1 + 0.25 if KEV-listed + EPSS ÷ 400. The published CVSS base score describes the flaw, not your estimate of risk. This calculator keeps that score as the anchor and applies four environment factors: whether an attacker can reach the asset, what the asset holds, whether the vulnerability is actually being exploited, and whether a compensating control already blocks the path. EPSS contributes at most 0.25 of uplift and KEV listing a flat 0.25, because confirmed in-the-wild use is the strongest single signal there is.

Every scanner hands you thousands of Highs and Criticals; the adjusted score is what turns that list into a work queue your change board will actually approve.

This calculator takes 6 inputs: Published CVSS base score, EPSS probability (30-day), Listed in CISA KEV, Exposure of the affected asset, Data on the affected asset, Compensating controls in place. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Yes, and it should. An internet-facing asset holding payment data with a KEV-listed CVE is a bigger problem than the abstract CVSS score suggests, and the multiplier chain is capped at 10 so it can never leave the scale.

Because a virtual patch, a WAF rule or a disabled feature reduces likelihood but leaves the vulnerable code in place, and every one of those controls has been bypassed in the field. Full credit is only earned by removing or patching the component.