Remote Code Execution Risk Calculator

Prioritise an RCE finding from exploit maturity, authentication needed, network exposure, patch status and lateral movement potential.

Inputs

RCE vector

Public exploit maturity

Authentication required to reach the sink

Network exposure

Patch or mitigation status

Asset criticality

Lateral movement potential from the host

Overall Risk Severity

Critical

Likelihood Score

7.80/ 9

Impact Score

7.50/ 9

Risk Score

6.50/ 9

Suggested Remediation Window

24hours

Recommended Action

Emergency change — patch or take the service offline now

Step by step

Values used
RCE vector = Insecure deserialisation — 7; Public exploit maturity = Weaponised in exploit kits — 9; Authentication required to reach the sink = None — 9; Network exposure = Internet-facing behind a WAF — 7; Patch or mitigation status = Vendor patch available but not applied — 7; Asset criticality = Customer-facing production — 7; Lateral movement potential from the host = Cloud role with broad permissions — 8
Remote Code Execution Risk
Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential).
Overall Risk Severity
= Critical
Likelihood Score
= 7.80 / 9
Impact Score
= 7.50 / 9
Risk Score
= 6.50 / 9
Suggested Remediation Window
= 24 hours
Recommended Action
= Emergency change — patch or take the service offline now

How it works

Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold. Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.

Formula

Remote Code Execution Risk

Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential).

exploitMaturity: 1 theoretical … 9 weaponised
lateral: 3 isolated … 9 cached domain admin credentials

Frequently Asked Questions

How is Remote Code Execution Risk calculated?

Likelihood = mean(vector, exploit maturity, authentication needed, network exposure, patch status); impact = mean(asset criticality, lateral movement potential). Exploit maturity and the authentication barrier dominate likelihood, because a weaponised unauthenticated exploit on an internet-facing host is being scanned for within hours of disclosure. Impact pairs the value of the host with what an attacker can reach from it, since RCE is rarely the objective — it is the foothold.

Why does Remote Code Execution Risk matter?

Patch queues are always longer than the maintenance window, so an RCE list ordered by exposure and lateral movement fixes the ones that actually end in a breach first.

What values do I need to enter?

This calculator takes 7 inputs: RCE vector, Public exploit maturity, Authentication required to reach the sink, Network exposure, Patch or mitigation status, Asset criticality, Lateral movement potential from the host. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does a WAF mitigation not score as 'patched'?

A virtual patch blocks the exploit shapes you know about at the edge, which buys days, not safety: request smuggling, alternate encodings and any internal path that skips the WAF all get through. It scores 6 rather than 1 because the vulnerable code is still there.

You might also need

Command Injection Risk Calculator File Upload Risk Calculator OWASP Risk Calculator