Skip to content
ENExplore Calculators

CVSS v3 Score Calculator

Compute a CVSS v3.1 base score from the eight base metrics, with the impact and exploitability sub-scores, vector string and severity rating.

About CVSS v3 Score Calculator

This is the published CVSS v3.1 base-metric arithmetic, not an approximation. The three impact metrics combine multiplicatively into the ISS so that a second High impact adds less than the first; the four exploitability metrics multiply into a 0–3.9 sub-score; and Privileges Required is read from the higher of two weight columns when Scope changes, because escaping the vulnerable component is worth more to an attacker. The final value uses the specification's integer Roundup(), which is why 8.75 becomes 8.8 and never 8.7. The base score is the number that drives your patch SLA, your vendor conversations and half your audit evidence — and reproducing it exactly is the only way to tell whether a vendor advisory has scored its own bug honestly.

Formulas

CVSS v3 Score

ISS = 1 − (1 − C)(1 − I)(1 − A). Impact = 6.42 × ISS when scope is unchanged, and 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15 when scope changes. Exploitability = 8.22 × AV × AC × PR × UI. Base = 0 if Impact ≤ 0, else roundup(min(Impact + Exploitability, 10)), or roundup(min(1.08 × (Impact + Exploitability), 10)) when scope changes.

ISS
Impact Sub-Score from the three C/I/A weights
C, I, A
0.56 High, 0.22 Low, 0 None
AV, AC, PR, UI
Published metric weights; PR depends on Scope
roundup
Round up to one decimal place, always upward

Official Roundup() function

Roundup(x) = int(x × 100000); if that integer is divisible by 10000 it is exact, so return it ÷ 100000, otherwise return (floor(int ÷ 10000) + 1) ÷ 10.

100000
Integer scaling that avoids binary floating-point error
x
Un-rounded score before capping to one decimal

Worked example

With the default values below, CVSS v3 Score Calculator returns CVSS v3.1 Base Score of 9.8. Change any input above and every figure here is recalculated in your browser.

Inputs used

Attack Vector (AV)one of Network (N) — 0.85, Adjacent Network (A) — 0.62, Local (L) — 0.55, Physical (P) — 0.20
Network (N) — 0.85
Attack Complexity (AC)one of Low (L) — 0.77, High (H) — 0.44
Low (L) — 0.77
Privileges Required (PR)one of None (N) — 0.85, Low (L) — 0.62 unchanged / 0.68 changed, High (H) — 0.27 unchanged / 0.50 changed
None (N) — 0.85
User Interaction (UI)one of None (N) — 0.85, Required (R) — 0.62
None (N) — 0.85
Scope (S)one of Unchanged (U), Changed (C)
Unchanged (U)
Confidentiality Impact (C)one of High (H) — 0.56, Low (L) — 0.22, None (N) — 0.00
High (H) — 0.56
Integrity Impact (I)one of High (H) — 0.56, Low (L) — 0.22, None (N) — 0.00
High (H) — 0.56
Availability Impact (A)one of High (H) — 0.56, Low (L) — 0.22, None (N) — 0.00
High (H) — 0.56

Results

CVSS v3.1 Base Score
9.8 / 10
Severity Rating
Critical
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Sub-Score
5.87
Exploitability Sub-Score
3.89
ISS — Combined C/I/A Impact
0.915
Suggested Remediation SLA
7 days

Step by step

  1. 1Values used
  2. 2CVSS v3 Score
  3. 3Official Roundup() function
  4. 4CVSS v3.1 Base Score= 9.8 / 10
  5. 5Severity Rating= Critical
  6. 6Vector String= CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  7. 7Impact Sub-Score= 5.87
  8. 8Exploitability Sub-Score= 3.89
  9. 9ISS — Combined C/I/A Impact= 0.915

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is CVSS v3 Score calculated?

ISS = 1 − (1 − C)(1 − I)(1 − A). Impact = 6.42 × ISS when scope is unchanged, and 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)^15 when scope changes. Exploitability = 8.22 × AV × AC × PR × UI. Base = 0 if Impact ≤ 0, else roundup(min(Impact + Exploitability, 10)), or roundup(min(1.08 × (Impact + Exploitability), 10)) when scope changes. This is the published CVSS v3.1 base-metric arithmetic, not an approximation. The three impact metrics combine multiplicatively into the ISS so that a second High impact adds less than the first; the four exploitability metrics multiply into a 0–3.9 sub-score; and Privileges Required is read from the higher of two weight columns when Scope changes, because escaping the vulnerable component is worth more to an attacker. The final value uses the specification's integer Roundup(), which is why 8.75 becomes 8.8 and never 8.7.

Why does CVSS v3 Score matter?

The base score is the number that drives your patch SLA, your vendor conversations and half your audit evidence — and reproducing it exactly is the only way to tell whether a vendor advisory has scored its own bug honestly.

What values do I need to enter?

This calculator takes 8 inputs: Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Scope (S), Confidentiality Impact (C), Integrity Impact (I), Availability Impact (A). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does my score differ from the vendor advisory by a few tenths?

Almost always because of Scope or Privileges Required. Vendors frequently score a bug as Scope:Unchanged when a sandbox escape or hypervisor break makes it Changed, and the 1.08 multiplier plus the higher PR weights can move the score by more than a point. Compare vector strings, not scores.

Is a 9.8 always more urgent than a 7.5?

No. The base score deliberately excludes your environment and the real world, so a 9.8 in a component you do not expose is less urgent than a 7.5 that is listed in CISA KEV with a high EPSS score. Use the base score for severity and the patch priority calculator for order of work.

What about temporal and environmental metrics?

They are separate metric groups that modify the base score for exploit maturity, remediation level and your own C/I/A requirements. This calculator implements the base group only, which is what CVE records and vendor advisories publish.

Related Calculators

CVSS v3 Score Calculator – Calculate CVSS v3.1 Base Score