CVSS Base Score Calculator

Work out cvss base score instantly with clear inputs, formula shown and shareable results.

About CVSS Base Score Calculator

CVSS v3.1 combines an exploitability subscore from attack vector, complexity, privileges required and user interaction with an impact subscore derived from confidentiality, integrity and availability. Impact uses 1 - (1-C)(1-I)(1-A) so multiple partial impacts combine sub-additively, and the total is rounded up to one decimal. A zero impact forces a zero score regardless of how easy the attack is.

Formula

CVSS v3.1 base

exploitability = 8.22 x AV x AC x PR x UI; ISC = 1 - (1-C)(1-I)(1-A); impact = 6.42 x ISC; base = roundup(min(impact + exploitability, 10))

Worked example

With the default values below, CVSS Base Score Calculator returns CVSS v3.1 base score of 9.8. Change any input above and every figure here is recalculated in your browser.

Inputs used

Attack vectorone of Network (0.85), Adjacent network (0.62), Local (0.55), Physical (0.2): Network (0.85)
Attack complexity and privilegesone of Low complexity, no privileges, Low complexity, low privileges, Low complexity, high privileges, High complexity, no privileges: Low complexity, no privileges
User interactionone of None (0.85), Required (0.62): None (0.85)
Confidentiality / integrity / availability impactone of High on all three, High on one, none on others, Low on all three, Low on one, none on others: High on all three

Results

CVSS v3.1 base score: 9.8
Exploitability subscore: 3.887
Impact subscore: 5.873
Qualitative severity: Critical

Step by step

1Values used
2CVSS v3.1 base
3CVSS v3.1 base score= 9.8
4Exploitability subscore= 3.887
5Impact subscore= 5.873
6Qualitative severity= Critical

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why does privileges required depend on scope?

When scope changes, the privileges-required weights are higher (0.68 low, 0.5 high) because escaping the vulnerable component's authorisation boundary is more serious.

Should CVSS drive patch priority on its own?

No. It measures severity in the abstract with no knowledge of exploitation in the wild or your environment. Combine it with EPSS and asset criticality.