CVSS 3.1 calculator
Select the metrics, get the vector and the base score — identical to FIRST.org's reference calculator — and read under the number what it means, in plain English.
Reading a vector from left to right
A vector is a sequence of fields separated by slashes. Each one answers a question, always in the same order. Take the one for Log4Shell, CVE-2021-44228:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
| Field | Value | What it says |
|---|---|---|
| AV | Network | Attackable from the Internet, without being on the same network. |
| AC | Low | No conditions to meet: the attack succeeds every time. |
| PR | None | No account needed on the target machine. |
| UI | None | Nobody needs to click. |
| S | Modified | The flaw spills beyond the library and reaches the whole machine. |
| C / I / A | High × 3 | Read, modify and shut down: nothing holds. |
The calculator above rewrites this string in plain English under the score, on every click. Load the “Log4Shell” case, then change a single field to see the mechanism:
- Scope changed → unchanged (
S:C→S:U): 10.0 becomes 9.8. It is the only field that separates the NVD's two most common scores. - Privileges none → high (
PR:N→PR:H): 10.0 becomes 9.1. Requiring an administrator account takes off almost a full point.
What the number means
The base score lives between 0.0 and 10.0 and falls into five bands. These bands are conventions: nothing inherently distinguishes a 6.9 from a 7.0, except a threshold the specification set.
| Score | Severity | What it means in practice |
|---|---|---|
| 9.0 – 10.0 | Critical | Full compromise, often with no account and no click. A successful exploit leaves nothing standing. |
| 7.0 – 8.9 | High | Heavy impact, but one condition is missing: an account, a click, local access. |
| 4.0 – 6.9 | Medium | Partial impact, or several conditions must be met. |
| 0.1 – 3.9 | Low | Minor leak, limited denial of service, or heavily constrained exploitation. |
| 0.0 | None | No reported impact on confidentiality, integrity or availability. |
Base, temporal, environmental: three layers, only one is about you
The base score describes the flaw as published. It is the one everyone cites, and it no longer changes.
The temporal score adjusts it to the state of the world: a functional exploit is circulating, or conversely an official fix has been released. On our 9.8 example, declaring an official fix available brings the score down to 9.4.
The environmental score is the only one that talks about your estate. It rests on two levers: the requirements (what confidentiality, integrity and availability are worth on that particular system of yours) and the modified metrics (what your deployment changes about the real exposure). Two examples calculated with the tool above, starting from the same 9.8:
- The service is only reachable through a VPN: Modified Attack Vector set to Local → 8.4.
- It is a staging environment with no real data: the three requirements set to Low → 8.0.
Filling in these fields takes two minutes, and it is what turns a public rating into an argument you can defend in front of management.
In practice, on Monday morning
The order that holds up in a real week, from most to least decisive:
- Is the flaw exploited today? If it is in KEV and the product runs in your environment, you handle it within 48 hours, whatever the score.
- How likely is it to be exploited within 30 days? That is EPSS. Above 0.1, you schedule it.
- How bad is the damage if it is? This is where CVSS comes in, to break the tie between two equally likely flaws.
That is the order our platform applies on your behalf, and the reason we start by asking what you run, not what you fear. See how targeted CVE monitoring is built.
Sources
- CVSS 3.1 specification — FIRST.org, the authoritative document.
- 3.1 reference calculator — to cross-check a score.
- CVSS at the NVD — the source of the scores published on CVEs.
FAQ
Should a CVSS 9.8 be fixed before a 7.5?
Not automatically. CVSS measures what would happen if the flaw were exploited, never the likelihood that it will be. A 7.5 already listed in the KEV catalog, and therefore exploited today, comes before a theoretical 9.8 for which nobody has published an exploit. The order that works: confirmed exploitation, then likelihood of exploitation, then severity.
Why does my score differ from the one shown by the NVD?
Three causes, in order of frequency. You did not select exactly the same vector: compare the two strings field by field. The CVE carries several scores: the CNA's (CVE Numbering Authority, the organization that assigns the identifier) and the NVD's, which regularly diverge. Or you are comparing a base score with an environmental score.
Can a CVE's score change after publication?
Yes, and often. A CNA publishes a provisional vector, the NVD reassesses it, the vendor sometimes disputes it. The temporal metrics move too: a published exploit raises the maturity, an official fix brings the temporal score back down.
Should you fill in the environmental metrics?
It is the only layer that talks about you rather than about the flaw, so yes, as soon as the decision commits a budget or a maintenance window. On a service reachable only through a VPN, changing the Modified Attack Vector from Network to Local drops our example from 9.8 to 8.4.
Is the calculation done on your servers?
No. Everything runs in your browser: the vector you build is sent nowhere. The “Copy link” button simply encodes the vector in the page address.
Free plan, no card
Get only the CVEs that affect your actual estate.
Declare your components once. We alert you as soon as a flaw affects one of them, already prioritized by KEV and EPSS, on the channel of your choice. The first alert goes out at the next sync.
- Free, no credit card
- Built & hosted in France
- Export your data at any time