Exploitability Calculator

Compute the CVSS exploitability sub-score from AV, AC, PR and UI, normalise it to 0–10 and adjust it for exploit maturity.

Inputs

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Exploit maturity (CVSS E metric)

Exploitability (0–10 scale)

10.00/ 10

CVSS Exploitability Sub-Score

3.887of 3.9

Maturity-Adjusted Exploitability

9.70/ 10

Rating

Trivially exploitable — remote, unauthenticated, no interaction

Hardest Barrier for the Attacker

None — remote, unauthenticated and silent

Relative Attempt Volume

97.00× baseline

Step by step

Values used
Attack Vector = Network — 0.85; Attack Complexity = Low — 0.77; Privileges Required = None — 0.85; User Interaction = None — 0.85; Exploit maturity (CVSS E metric) = Functional exploit — 0.97
Exploitability
Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier.
Relative attempt volume
Relative attempt volume = normalised exploitability × maturity × 100, an index rather than a real rate — use it to compare two findings, not to predict traffic.
Exploitability (0–10 scale)
= 10.00 / 10
CVSS Exploitability Sub-Score
= 3.887 of 3.9
Maturity-Adjusted Exploitability
= 9.70 / 10
Rating
= Trivially exploitable — remote, unauthenticated, no interaction
Hardest Barrier for the Attacker
= None — remote, unauthenticated and silent
Relative Attempt Volume
= 97.00 × baseline

How it works

The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%. Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.

Formulas

Exploitability

8.22: CVSS scaling constant
AV, AC, PR, UI: Published metric weights
3.887: Sub-score maximum, at AV:N/AC:L/PR:N/UI:N
maturity: 0.91 unproven … 1.00 weaponised

Relative attempt volume

Relative attempt volume = normalised exploitability × maturity × 100, an index rather than a real rate — use it to compare two findings, not to predict traffic.

Frequently Asked Questions

How is Exploitability calculated?

Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier. The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%.

Why does Exploitability matter?

Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.

What values do I need to enter?

This calculator takes 5 inputs: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Exploit maturity (CVSS E metric). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does exploit maturity change the score so little?

Because CVSS treats it as a small discount on a theoretical worst case rather than a prediction. If you want exploitation likelihood rather than ease, use EPSS and KEV in the exploit probability calculator — they move the answer by orders of magnitude, not percent.

Does low exploitability mean I can defer the patch?

Only in combination with low exposure. Local-only bugs become critical the moment an attacker has any foothold, which is why privilege-escalation findings on shared servers should be treated far more seriously than their exploitability score suggests.

You might also need

CVSS v3 Score Calculator Exploit Probability Calculator Patch Priority Calculator