Skip to content
ENExplore Calculators

CVE Severity Calculator

Adjust a published CVSS base score for EPSS probability, KEV listing, exposure, data sensitivity and compensating controls.

About CVE Severity Calculator

The published CVSS base score describes the flaw, not your estimate of risk. This calculator keeps that score as the anchor and applies four environment factors: whether an attacker can reach the asset, what the asset holds, whether the vulnerability is actually being exploited, and whether a compensating control already blocks the path. EPSS contributes at most 0.25 of uplift and KEV listing a flat 0.25, because confirmed in-the-wild use is the strongest single signal there is. Every scanner hands you thousands of Highs and Criticals; the adjusted score is what turns that list into a work queue your change board will actually approve.

Formulas

CVE Severity

Adjusted = min(10, base × exposure × sensitivity × threatMultiplier × (1 − controlReduction)), where threatMultiplier = 1 + 0.25 if KEV-listed + EPSS ÷ 400.

base
Published CVSS base score
exposure
0.70 isolated … 1.15 internet-facing
sensitivity
0.85 public data … 1.20 credentials
threatMultiplier
1.00–1.50 uplift from real-world exploitation signals

Threat uplift

threatMultiplier = 1 + 0.25·KEV + EPSS% ÷ 400, so a KEV-listed CVE with a 100% EPSS score is worth a 1.5× uplift.

Worked example

With the default values below, CVE Severity Calculator returns Environment-Adjusted Severity of 10.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Published CVSS base scoreaccepts 0–10 / 10
8.8 / 10
EPSS probability (30-day)accepts 0–100 %
12 %
Listed in CISA KEV
Yes
Exposure of the affected assetone of Isolated or air-gapped — ×0.70, Internal only — ×0.85, Partner or VPN reachable — ×1.00, Internet-facing — ×1.15
Internet-facing — ×1.15
Data on the affected assetone of Public or test data — ×0.85, Internal business data — ×1.00, Regulated PII or payment data — ×1.10, Credentials, keys or the primary customer store — ×1.20
Regulated PII or payment data — ×1.10
Compensating controls in placeone of None — 0% reduction, Detection only — 20% reduction, Virtual patch or WAF rule — 40% reduction, Feature disabled or asset isolated — 60% reduction
Detection only — 20% reduction

Results

Environment-Adjusted Severity
10.0 / 10
Adjusted Severity Rating
Critical
Published Severity Rating
High
Change vs Published Score
13.6%
Threat Multiplier
1.28 ×
Suggested Remediation SLA
3 days
Recommended Action
Emergency change — KEV listed and high adjusted severity

Step by step

  1. 1Values used
  2. 2CVE Severity
  3. 3Threat uplift
  4. 4Environment-Adjusted Severity= 10.0 / 10
  5. 5Adjusted Severity Rating= Critical
  6. 6Published Severity Rating= High
  7. 7Change vs Published Score= 13.6
  8. 8Threat Multiplier= 1.28 ×
  9. 9Suggested Remediation SLA= 3 days

Assumptions and limits

  • The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is CVE Severity calculated?

Adjusted = min(10, base × exposure × sensitivity × threatMultiplier × (1 − controlReduction)), where threatMultiplier = 1 + 0.25 if KEV-listed + EPSS ÷ 400. The published CVSS base score describes the flaw, not your estimate of risk. This calculator keeps that score as the anchor and applies four environment factors: whether an attacker can reach the asset, what the asset holds, whether the vulnerability is actually being exploited, and whether a compensating control already blocks the path. EPSS contributes at most 0.25 of uplift and KEV listing a flat 0.25, because confirmed in-the-wild use is the strongest single signal there is.

Why does CVE Severity matter?

Every scanner hands you thousands of Highs and Criticals; the adjusted score is what turns that list into a work queue your change board will actually approve.

What values do I need to enter?

This calculator takes 6 inputs: Published CVSS base score, EPSS probability (30-day), Listed in CISA KEV, Exposure of the affected asset, Data on the affected asset, Compensating controls in place. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Can the adjusted score go above the base score?

Yes, and it should. An internet-facing asset holding payment data with a KEV-listed CVE is a bigger problem than the abstract CVSS score suggests, and the multiplier chain is capped at 10 so it can never leave the scale.

Why cap compensating-control credit at 60%?

Because a virtual patch, a WAF rule or a disabled feature reduces likelihood but leaves the vulnerable code in place, and every one of those controls has been bypassed in the field. Full credit is only earned by removing or patching the component.

Related Calculators

CVE Severity Calculator | Calcrivo