Remote Code Execution Risk Calculator

Prioritise an RCE finding from exploit maturity, authentication needed, network exposure, patch status and lateral movement potential.

About Remote Code Execution Risk Calculator

Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold. Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.

Formula

Remote Code Execution Risk

Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential).

exploitMaturity: 1 theoretical … 9 weaponised
lateral: 3 isolated … 9 cached domain admin credentials

Worked example

With the default values below, Remote Code Execution Risk Calculator returns Overall Risk Severity of Critical. Change any input above and every figure here is recalculated in your browser.

Inputs used

RCE vectorone of Memory-safety bug needing a bespoke exploit — 5, Insecure deserialisation — 7, Server-side template injection — 8, Unauthenticated upload and execute — 9: Insecure deserialisation — 7
Public exploit maturityone of Theoretical, no proof of concept — 1, Private proof of concept — 3, Public proof of concept — 6, Weaponised in exploit kits — 9: Weaponised in exploit kits — 9
Authentication required to reach the sinkone of Administrator — 2, Authenticated user — 5, None — 9: None — 9
Network exposureone of Internal and segmented — 2, Internal on a flat network — 5, Internet-facing behind a WAF — 7, Internet-facing with no filtering — 9: Internet-facing behind a WAF — 7
Patch or mitigation statusone of Patched — 1, Configuration or WAF mitigation only — 6, Vendor patch available but not applied — 7, No fix available — 9: Vendor patch available but not applied — 7
Asset criticalityone of Development sandbox — 2, Internal tooling — 5, Customer-facing production — 7, Payment or identity provider — 9: Customer-facing production — 7
Lateral movement potential from the hostone of Isolated, no credentials on the host — 3, Same-tier hosts reachable — 5, Cloud role with broad permissions — 8, Domain-joined with cached admin credentials — 9: Cloud role with broad permissions — 8

Results

Overall Risk Severity: Critical
Likelihood Score: 7.80 / 9
Impact Score: 7.50 / 9
Risk Score: 6.50 / 9
Suggested Remediation Window: 24 hours
Recommended Action: Emergency change — patch or take the service offline now

Step by step

1Values used
2Remote Code Execution Risk
3Overall Risk Severity= Critical
4Likelihood Score= 7.80 / 9
5Impact Score= 7.50 / 9
6Risk Score= 6.50 / 9
7Suggested Remediation Window= 24 hours
8Recommended Action= Emergency change — patch or take the service offline now

Assumptions and limits

The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Remote Code Execution Risk calculated?

Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential). Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold.

Why does Remote Code Execution Risk matter?

Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.

What values do I need to enter?

This calculator takes 7 inputs: RCE vector, Public exploit maturity, Authentication required to reach the sink, Network exposure, Patch or mitigation status, Asset criticality, Lateral movement potential from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does a WAF mitigation not score as 'patched'?

A virtual patch blocks the exploit shapes you know about at the edge, which buys days, not safety: request smuggling, alternate encodings and any internal path that skips the WAF all get through. It scores 6 rather than 1 because the vulnerable code is still there.