Compute the CVSS exploitability sub-score from AV, AC, PR and UI, normalise it to 0–10 and adjust it for exploit maturity.
The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%. Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.
Exploitability
Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier.
Relative attempt volume
Relative attempt volume = normalised exploitability × maturity × 100, an index rather than a real rate — use it to compare two findings, not to predict traffic.
Exploitability = 8.22 × AV × AC × PR × UI, the CVSS v3.1 sub-score; normalised to 0–10 by dividing by its maximum of 3.887 and multiplying by ten, then scaled by the exploit-maturity multiplier. The four exploitability metrics multiply, so barriers compound: requiring both high privileges and user interaction cuts the sub-score by roughly two thirds. Normalising to 0–10 makes the figure comparable with a base score, and the maturity multiplier is CVSS's own temporal Exploit Code Maturity metric, which never reduces a score by more than 9%.
Two findings with the same impact and the same base score can differ by five points of exploitability, and that is the difference between a scheduled patch and a Friday-night change.
This calculator takes 5 inputs: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Exploit maturity (CVSS E metric). The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because CVSS treats it as a small discount on a theoretical worst case rather than a prediction. If you want exploitation likelihood rather than ease, use EPSS and KEV in the exploit probability calculator — they move the answer by orders of magnitude, not percent.
Only in combination with low exposure. Local-only bugs become critical the moment an attacker has any foothold, which is why privilege-escalation findings on shared servers should be treated far more seriously than their exploitability score suggests.