CVSS v4 Score Calculator

The six equivalence classes are derived as published: EQ1 from AV/PR/UI, EQ2 from AC/AT, EQ3 from VC/VI/VA, EQ4 from SC/SI/SA plus safety, EQ5 from exploit maturity, EQ6 from CR/IR/AR against the high impact dimensions. Score = 10 − (w1·EQ1 + w2·EQ2 + w3·EQ3 + w4·EQ4 + w5·EQ5 + w6·EQ6), clamped to 0.1–10, or 0 when nothing is impacted. CVSS 4.0 replaces v3's single formula with a macro-vector: each metric group collapses to an equivalence class, and the official specification then looks the resulting six-digit macro-vector up in a 270-row table and interpolates between neighbouring rows. This calculator derives the macro-vector exactly as published but converts it to a score with a documented monotone weighting rather than that lookup table, so treat the number as a close approximation and use the official FIRST calculator for anything you publish.

v4 finally separates what the bug does to the vulnerable system from what it does to everything downstream, and the macro-vector alone tells you more about urgency than a v3 base score does — a 000000 macro-vector is an unauthenticated remote takeover under active exploitation, whatever the arithmetic says.

This calculator takes 16 inputs: Attack Vector (AV), Attack Complexity (AC), Attack Requirements (AT), Privileges Required (PR), User Interaction (UI), Vulnerable system — Confidentiality (VC), Vulnerable system — Integrity (VI), Vulnerable system — Availability (VA), Subsequent system — Confidentiality (SC), Subsequent system — Integrity (SI), Subsequent system — Availability (SA), Exploit Maturity (E), Safety impact on a subsequent system (MSI:S or MSA:S), Confidentiality Requirement (CR), Integrity Requirement (IR), Availability Requirement (AR). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because the authoritative v4 score comes from a published 270-row macro-vector lookup with interpolation across neighbouring rows. Reproducing that table verbatim is the only way to be exact, so this calculator uses a documented weighting instead and is explicit about it. The macro-vector, the vector string and the class derivation are exact.

Anything outside the vulnerable component that the exploit affects — the host behind a hypervisor, the network behind a firewall, the plant behind a controller. It replaces v3's Scope flag with three real impact metrics, which is the single biggest improvement in v4.

Score in whichever version your data source publishes and do not mix them in one metric. v4 is better for OT, safety and chained impact; v3.1 still dominates CVE records, so most teams run both for a while and prioritise with EPSS and KEV rather than with either score alone.