CVSS Calculator

What Is CVSS

The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the severity of software vulnerabilities. Maintained by the Forum of Incident Response and Security Teams (FIRST), CVSS provides a standardized numerical score from 0.0 to 10.0 that reflects the technical severity of a vulnerability, helping organizations prioritize remediation efforts.

CVSS is the de facto standard used by the National Vulnerability Database (NVD), vulnerability scanners like Nessus and Qualys, and compliance frameworks including PCI DSS and FedRAMP. Understanding how CVSS scores are calculated enables security teams to make informed patching decisions rather than treating every vulnerability as equally urgent.

How CVSS Scoring Works

CVSS 3.1 (the current widely-deployed version) calculates scores using three metric groups:

Base Score Metrics

Metric	Options	Measures
Attack Vector (AV)	Network, Adjacent, Local, Physical	How the attacker reaches the vulnerability
Attack Complexity (AC)	Low, High	Conditions beyond attacker control required for exploitation
Privileges Required (PR)	None, Low, High	Authentication level needed
User Interaction (UI)	None, Required	Whether a victim must take action
Scope (S)	Unchanged, Changed	Whether exploitation impacts resources beyond the vulnerable component
Confidentiality (C)	None, Low, High	Impact on information disclosure
Integrity (I)	None, Low, High	Impact on data modification
Availability (A)	None, Low, High	Impact on system accessibility

Severity Ratings

Score Range	Severity	Typical Response
0.0	None	No action needed
0.1 - 3.9	Low	Patch in next maintenance window
4.0 - 6.9	Medium	Patch within 30 days
7.0 - 8.9	High	Patch within 1-2 weeks
9.0 - 10.0	Critical	Immediate patching or mitigation

Common Use Cases

• Vulnerability prioritization: Rank hundreds of scanner findings by CVSS score to focus remediation on the most severe issues first
• SLA definition: Establish patching timelines tied to CVSS severity levels in your vulnerability management policy
• Risk communication: Translate technical vulnerability details into a standardized score that non-technical stakeholders can understand
• Compliance evidence: PCI DSS Requirement 6.1 requires ranking vulnerabilities by risk — CVSS provides the recognized methodology
• Vendor comparisons: Evaluate the security track record of third-party software by analyzing historical CVSS distributions

Best Practices

1. Use Environmental metrics for context — The Base Score reflects generic severity. Use the Environmental metric group to adjust scores based on your specific deployment: a network-accessible vulnerability in an air-gapped system is less critical than the base score suggests.
2. Don't ignore Medium-severity findings — Organizations that only patch Critical and High CVEs accumulate a growing attack surface of exploitable Medium vulnerabilities. Address these within defined SLAs.
3. Combine CVSS with exploit intelligence — A CVSS 7.5 vulnerability with a public Metasploit module poses more immediate risk than a CVSS 9.0 with no known exploit. Cross-reference with CISA KEV, Exploit-DB, and threat intelligence feeds.
4. Understand CVSS 4.0 changes — CVSS 4.0 introduces granular attack requirements, updated environmental metrics, and supplemental metrics for automatable attacks and recovery. Plan your transition from 3.1 to 4.0.
5. Document your scoring rationale — When you adjust scores using Temporal or Environmental metrics, record why. Auditors and future analysts need to understand your risk acceptance decisions.