Skip to content
ENExplore Calculators

Exploitability Calculator

Compute the CVSS exploitability sub-score from AV, AC, PR and UI, normalise it to 0–10 and adjust it for exploit maturity.

About Exploitability Calculator

The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%. Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.

Formulas

Exploitability

Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier.

8.22
CVSS scaling constant
AV, AC, PR, UI
Published metric weights
3.887
Sub-score maximum, at AV:N/AC:L/PR:N/UI:N
maturity
0.91 unproven … 1.00 weaponised

Relative attempt volume

Relative attempt volume = normalised exploitability × maturity × 100, an index rather than a real rate — use it to compare two findings, not to predict traffic.

Worked example

With the default values below, Exploitability Calculator returns Exploitability (0–10 scale) of 10.00. Change any input above and every figure here is recalculated in your browser.

Inputs used

Attack Vectorone of Network — 0.85, Adjacent network — 0.62, Local — 0.55, Physical — 0.20
Network — 0.85
Attack Complexityone of Low — 0.77, High — 0.44
Low — 0.77
Privileges Requiredone of None — 0.85, Low — 0.62, High — 0.27
None — 0.85
User Interactionone of None — 0.85, Required — 0.62
None — 0.85
Exploit maturity (CVSS E metric)one of Unproven — 0.91, Proof of concept — 0.94, Functional exploit — 0.97, High, weaponised and reliable — 1.00
Functional exploit — 0.97

Results

Exploitability (0–10 scale)
10.00 / 10
CVSS Exploitability Sub-Score
3.887 of 3.9
Maturity-Adjusted Exploitability
9.70 / 10
Rating
Trivially exploitable — remote, unauthenticated, no interaction
Hardest Barrier for the Attacker
None — remote, unauthenticated and silent
Relative Attempt Volume
97.00 × baseline

Step by step

  1. 1Values used
  2. 2Exploitability
  3. 3Relative attempt volume
  4. 4Exploitability (0–10 scale)= 10.00 / 10
  5. 5CVSS Exploitability Sub-Score= 3.887 of 3.9
  6. 6Maturity-Adjusted Exploitability= 9.70 / 10
  7. 7Rating= Trivially exploitable — remote, unauthenticated, no interaction
  8. 8Hardest Barrier for the Attacker= None — remote, unauthenticated and silent
  9. 9Relative Attempt Volume= 97.00 × baseline

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Exploitability calculated?

Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier. The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%.

Why does Exploitability matter?

Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.

What values do I need to enter?

This calculator takes 5 inputs: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Exploit maturity (CVSS E metric). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does exploit maturity change the score so little?

Because CVSS treats it as a small discount on a theoretical worst case rather than a prediction. If you want exploitation likelihood rather than ease, use EPSS and KEV in the exploit probability calculator — they move the answer by orders of magnitude, not percent.

Does low exploitability mean I can defer the patch?

Only in combination with low exposure. Local-only bugs become critical the moment an attacker has any foothold, which is why privilege-escalation findings on shared servers should be treated far more seriously than their exploitability score suggests.

Related Calculators

Exploitability Calculator | Calcrivo