CVSS 4.0 calculator
The latest version separates the impact on the vulnerable component from the impact on what sits behind it. Build the vector and see what that separation changes.
What 4.0 changes, field by field
The CVSS 4.0 was published by FIRST.org in November 2023 in response to a recurring complaint: in 3.1, half of all CVEs bunched up on a handful of scores, and the rating said little about the real impact. Four changes carry most of the weight.
| CVSS 3.1 | CVSS 4.0 | Why |
|---|---|---|
| Scope (S) | VC/VI/VA + SC/SI/SA | Instead of a yes/no, what happens to the vulnerable component and what happens behind it are scored separately. |
| Attack Complexity (AC) | AC + AT | What the attacker works around (AC) is separated from what they must wait for or endure (AT, Attack Requirements). |
| User Interaction (UI:N/R) | UI:N/P/A | A deliberate click and ordinary browsing do not cost the attacker the same effort. |
| Exploit Maturity (E) | E:A/P/U | Three clear-cut states: attacks observed, proof of concept published, nothing reported. |
The calculator above offers four preloaded cases. The most telling is “Hypervisor escape”: a local flaw, unremarkable in 3.1, that reaches the guest virtual machines. Load it, then switch the three subsequent system impacts to None to see the difference 4.0 can express, and that 3.1 reduced to a single bit.
What the number means
The severity bands are the same as in 3.1, which keeps a constant confusion going: an 8.6 in 4.0 and an 8.6 in 3.1 do not describe the same thing, yet they carry the same label.
| Score | Severity | What it means in practice |
|---|---|---|
| 9.0 – 10.0 | Critical | Full compromise, often with no account and no click. A successful exploit leaves nothing standing. |
| 7.0 – 8.9 | High | Heavy impact, but one condition is missing: an account, a click, local access. |
| 4.0 – 6.9 | Medium | Partial impact, or several conditions must be met. |
| 0.1 – 3.9 | Low | Minor leak, limited denial of service, or heavily constrained exploitation. |
| 0.0 | None | No reported impact on confidentiality, integrity or availability. |
Base, threat, environmental: the new nomenclature
4.0 renames the layers to break a bad habit: publishing a base score and calling it “the” score. The names are now CVSS-B (base only), CVSS-BT (base and threat), CVSS-BE (base and environmental) and CVSS-BTE (everything). The name says what was actually filled in.
The temporal group becomes the threat group and shrinks to a single metric, exploit maturity: Remediation Level and Report Confidence are gone, having never been filled in seriously.
What it means for you, in practice
Three habits that avoid the most common mistakes:
- Keep the original version in your tracking. The prefix
CVSS:4.0/is part of the vector: without it, nobody will know which scale you are quoting. - Fill in exploit maturity when you know it. It is the only field in the threat group, and the one that brings the score closest to what happens in the field.
- Still don't prioritize on this number alone. 4.0 describes impact better, but it still does not predict exploitation. Cross-check with EPSS and KEV: that is the job of CVE monitoring targeted at your estate.
Sources
- CVSS 4.0 specification — FIRST.org.
- 4.0 reference calculator — to cross-check a score.
FAQ
Should you switch to CVSS 4.0 now?
Use the version your source publishes. The NVD and most CNAs (CVE Numbering Authorities, the organizations that assign CVE identifiers) still publish 3.1; some vendors publish both. Recomputing in 4.0 a vector given in 3.1 produces a number comparable to nothing: the two scales do not convert.
What replaces the 3.1 Scope?
Six impact metrics instead of three. VC, VI and VA describe what happens to the vulnerable component; SC, SI and SA describe what happens to the systems behind it. Where 3.1 only said “it spills over”, 4.0 says by how much and onto what.
What is the difference between complexity and attack requirements?
Complexity measures what the attacker must actively get around: a memory protection, a signature check. Attack requirements measure what they must wait for or endure: a race between two processes, a particular load, a position on the network. 3.1 lumped the two into a single field.
What exactly does this calculator cover?
The base vector, exploit maturity and the three security requirements (CR, IR, AR), computed with FIRST.org's official macro-vector table. Modified environmental metrics (MAV, MSI:S…) and supplemental metrics (Automatable, Recovery, Safety) are not supported yet: we would rather say so than let you find out.
Free plan, no card
Get only the CVEs that affect your actual estate.
Declare your components once. We alert you as soon as a flaw affects one of them, already prioritized by KEV and EPSS, on the channel of your choice. The first alert goes out at the next sync.
- Free, no credit card
- Built & hosted in France
- Export your data at any time