CVSS Calculator

How to use the CVSS calculator

Click one value in each of the eight base-metric groups and the score, severity band and vector string update live. Optionally add the three temporal metrics (exploit maturity, remediation level, report confidence) to see the temporal score alongside the base score. Copy vector gives you the canonical string for a report or ticket; Copy link gives you this page with the vector pre-loaded — the score, shareable. Got a vector from an advisory? Paste it into the box at the bottom and Load vector reconstructs the whole assessment.

Choosing the base metrics honestly

Most scoring arguments are really definitions arguments, so anchor on the spec's intent. Attack Vector is about where the attacker can be: Network means remotely exploitable across the internet; Local means they need to run code or log in first. Attack Complexity is High only when success depends on conditions outside the attacker's control (a race to win, a target configuration they can't detect) — "it took me a while in the lab" is still Low. Privileges Required is judged before the attack, User Interaction asks whether a victim must do something (open the file, click the link). Scope is the subtle one: it flips to Changed when the exploited component's compromise crosses a security boundary into resources governed by a different authority — a hypervisor escape, a sandbox breakout, an XSS that runs in other users' browsers.

Impact: rate what the attacker gains, not what they touched

Confidentiality, Integrity and Availability describe the impact on the affected component: High means a total (or effectively total) loss — all data readable, arbitrary files writable, service fully down; Low means some access with no control over what or how much. A vulnerability that only leaks which software version is running is C:L, however embarrassing the bug. Rating every information disclosure C:H is the most common way scores drift upward until nobody trusts them.

What the bands mean (and don't)

0.1–3.9 is Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical. The famous 9.8 pattern — network-reachable, no privileges, no user interaction, full C/I/A impact — is the classic pre-auth remote code execution. But CVSS measures severity of the vulnerability, not risk to you: a 9.8 in software you don't expose may matter less than a 6.5 in your internet-facing login flow. Use the score to triage and communicate; use your environment to decide. (More on that distinction in the guide.)