CVSS v3.1 Base Score Calculator

Understanding the CVSS v3.1 base score calculator — concept and principle

The Common Vulnerability Scoring System (CVSS) gives a software vulnerability a number from 0.0 to 10.0 that describes its technical severity. The base score uses eight metrics that do not change over time or between environments. Security teams and vulnerability databases use it to compare flaws and set patching priorities.

Easy to exploit (3.89) plus full impact (5.87) rounds up to 9.8, the Critical band.

How it is calculated

The FIRST CVSS v3.1 specification combines two sub-scores.

Impact sub-score: ISS = 1 − (1 − C) × (1 − I) × (1 − A), with High = 0.56, Low = 0.22, None = 0 for confidentiality, integrity and availability.
Impact: if Scope is Unchanged, 6.42 × ISS; if Changed, 7.52 × (ISS − 0.029) − 3.25 × (ISS − 0.02)¹⁵.
Exploitability: 8.22 × AV × AC × PR × UI. Attack vector Network 0.85, Adjacent 0.62, Local 0.55, Physical 0.2; complexity Low 0.77, High 0.44; privileges None 0.85, Low 0.62 (0.68 if Scope Changed), High 0.27 (0.5 if Changed); user interaction None 0.85, Required 0.62.
Base score: 0 if Impact ≤ 0. Otherwise Roundup(min(Impact + Exploitability, 10)) for Unchanged, or Roundup(min(1.08 × (Impact + Exploitability), 10)) for Changed. Roundup rounds up to one decimal.

The principle

The score asks two questions: how easy is the flaw to exploit, and how bad is the result? Exploitability multiplies the factors, so any hard requirement (physical access, high privileges) pulls the whole term down. ISS combines the three impacts like independent probabilities, so losing all three is worse than any single one but never exceeds 1. Scope Changed means the attack reaches beyond the vulnerable component, for example escaping a sandbox, so the score is boosted by 1.08 and privileges count for more.

Worked example

Inputs: AV Network, AC Low, PR None, UI None, Scope Unchanged, C/I/A High (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
ISS = 1 − 0.44³ = 1 − 0.085184 = 0.914816.
Impact = 6.42 × 0.914816 = 5.8731.
Exploitability = 8.22 × 0.85 × 0.77 × 0.85 × 0.85 = 3.8870.
Sum = 9.7602, below 10, rounded up to 9.8.
Severity: Critical.

How to read the result

Where does your result fall?

The v3.1 rating scale is None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. 9.8 is typical of a remote, unauthenticated, full-compromise flaw. The base score is not risk: whether the flaw is actively exploited, reachable in your network and on a critical system decides real urgency.

Common mistakes

Using ordinary rounding instead of rounding up (9.71 becomes 9.8, not 9.7).
Forgetting that Low/High privileges weigh more when Scope is Changed.
Treating the base score as the full risk rating and ignoring threat and environmental factors.

Keep in mind: The base score describes technical severity only. Prioritise patches with your own asset context and threat intelligence, not on the number alone.

Frequently asked questions

What is the difference between CVSS v3.1 and v4.0?

CVSS v4.0, published by FIRST in 2023, uses a different metric set and scoring method, so v3.1 and v4.0 scores should not be compared directly.

Who assigns the official score?

Usually the vendor or the CVE numbering authority; databases such as NVD may publish their own assessment.

Sources: FIRST, Common Vulnerability Scoring System v3.1: Specification Document · FIRST, CVSS v3.1 User Guide

Checked 8 Nov 2026. Standard formulas and RFC/IEEE definitions, computed locally in your browser — nothing you type is sent anywhere.

Your numbers