CVSS Environmental Score Calculator

Work out cvss environmental score instantly with clear inputs, formula shown and shareable results.

About CVSS Environmental Score Calculator

Environmental metrics re-weight impact by what your organisation actually cares about for a given asset. A vulnerability that only affects availability scores much lower on a batch reporting server than on a payment gateway. Because the requirement weights range from 0.5 to 1.5, the environmental score can rise above the base as well as fall below it — the only CVSS group that can.

Formula

Environmental adjustment

weights: High 1.5, Medium 1.0, Low 0.5; environmental = roundup(min(10, score x average of CR, IR, AR))

Worked example

With the default values below, CVSS Environmental Score Calculator returns Environmental score of 8.8. Change any input above and every figure here is recalculated in your browser.

Inputs used

CVSS base or temporal scoreaccepts 0.1–10: 8.8
Confidentiality requirementone of High (1.5), Medium (1.0), Low (0.5): High (1.5)
Integrity requirementone of High (1.5), Medium (1.0), Low (0.5): Medium (1.0)
Availability requirementone of High (1.5), Medium (1.0), Low (0.5): Low (0.5)

Results

Environmental score: 8.8
Average security requirement weight: 1.000
Change from the input score: 0.00
Qualitative severity: High

Step by step

1Values used
2Environmental adjustment
3Environmental score= 8.8
4Average security requirement weight= 1.000
5Change from the input score= 0.00
6Qualitative severity= High

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is this group so often left undefined?

It requires asset-level knowledge that vulnerability scanners do not have. Populating it is exactly what turns a generic CVSS feed into a prioritised work queue.

Can the environmental score exceed the base score?

Yes, when the security requirements are High. That is deliberate: a medium-severity flaw on a crown-jewel system can be more urgent than a high-severity one elsewhere.