CVSS Calculator (v3.1 and v4.0)

Pick the metrics, or paste a vector string, to get the CVSS base score and severity rating. Version 3.1 also gives temporal and environmental scores, and version 4.0 gives the CVSS-B, BT, BE or BTE score. The calculations follow FIRST's published specification and run in your browser.

Severity ratings

These ranges are the same in v3.1 and v4.0. A CVSS score measures technical severity, not risk to your own systems, which is why the environmental metrics exist.

The metric groups

• Base metrics describe the vulnerability itself and do not change over time: how it is reached (attack vector, complexity, privileges, user interaction) and what it does to confidentiality, integrity and availability.
• Temporal (v3.1) and Threat (v4.0) metrics reflect the current state of exploit code, and in v3.1 the fix and report confidence.
• Environmental metrics let you adjust the score for your own setup: how much the affected asset matters (confidentiality, integrity and availability requirements) and any modified base metrics.

What changed in v4.0

• A new base metric, Attack Requirements, covers conditions outside the attacker's control, and User Interaction now has Passive and Active values.
• The Scope metric is gone. Impact is scored separately for the vulnerable system and for any subsequent systems.
• Exploit Maturity is the only threat metric, and the nomenclature says which groups went into a score: CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE.
• Supplemental metrics (Safety, Automatable, Recovery, Value Density, Response Effort and Provider Urgency) are accepted in a pasted vector but never change the score.
• v4.0 scores come from a lookup of 270 MacroVectors, then an adjustment inside each one, instead of a single formula.

How we make sure it is correct

Version 3.1 uses the formulas, weights and Roundup function exactly as printed in the FIRST CVSS v3.1 specification. Version 4.0 uses FIRST's own open-source scoring code and lookup tables. Both match every worked example published by FIRST at first.org/cvss/v3-1/examples and first.org/cvss/v4-0/examples (46 v3.1 vectors and 51 v4.0 vectors, checked on 8 November 2026).

Study and related tools

Scoring and prioritising vulnerabilities is part of the CompTIA Security+ and CySA+ objectives. See the Security+ SY0-701 objectives guide, the CySA+ CS0-004 objectives guide, the free Security+ SY0-701 practice test and the free tools page.

CVSS calculator FAQ

What is a CVSS vector string?
A compact text form of the metrics, such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Paste one into the box and press Load to fill in the metrics.

Which version should I use?
Use the version your vendor or scanner reports. v4.0 is the current FIRST standard, published in November 2023, and v3.1 is still widely used. The same vulnerability can score differently in each version.

Why does a 0.0 score appear?
When confidentiality, integrity and availability impact are all None, nothing is affected and the score is 0.0.

Does it support CVSS v3.0 or v2?
No. Version 3.0 uses a slightly different rounding rule and modified impact formula, and v2 is a different system.

Embed this calculator

Want this CVSS calculator on your own site? It is free to embed. Copy the code below and keep the link underneath the calculator.

Copy the code

CVSS is owned and managed by FIRST.org, Inc. Formulas: CVSS v3.1 Specification Document, first.org/cvss/v3-1/specification-document. Version 4.0 scoring uses FIRST's open-source calculator code (github.com/FIRSTdotorg/cvss-v4-calculator), BSD-2-Clause licence reproduced below.

Copyright (c) 2023 FIRST.ORG, Inc., Red Hat, and contributors

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.