← All Tools

🛡 CVSS v4.0 Calculator

Score vulnerabilities using the official CVSS v4.0 methodology with Base, Threat, Environmental and Supplemental metric groups.

All processing happens locally in your browser. No data is sent to any server.

CVSS-B

Select all base metrics

Vector String

CVSS:4.0

Exploitability Metrics (Required)

Reflect the characteristics of the vulnerable system that influence how the vulnerability can be reached and triggered by an attacker.

Attack Vector (AV)

Attack Complexity (AC)

Attack Requirements (AT)

Privileges Required (PR)

User Interaction (UI)

Vulnerable System Impact (Required)

Capture the effects of a successfully exploited vulnerability on the vulnerable system itself.

Confidentiality (VC)

Integrity (VI)

Availability (VA)

Subsequent System Impact (Required)

Capture the effects of a successfully exploited vulnerability on systems other than the vulnerable system. Replaces the v3.1 "Scope" concept.

Confidentiality (SC)

Integrity (SI)

Availability (SA)

Threat Metrics (Optional)

Reflect the characteristics of a vulnerability related to threat that may change over time but not necessarily across user environments.

Exploit Maturity (E)

Security Requirements (Optional)

Enable customization of the score depending on the importance of the affected IT asset to the organization.

Confidentiality Requirement (CR)

Integrity Requirement (IR)

Availability Requirement (AR)

Modified Base Metrics (Optional)

Override individual base metrics based on specific characteristics of a user's environment. "Not Defined (X)" inherits the corresponding base metric value.

Modified Exploitability

Modified Attack Vector (MAV)

Modified Attack Complexity (MAC)

Modified Attack Requirements (MAT)

Modified Privileges Required (MPR)

Modified User Interaction (MUI)

Modified Vulnerable System Impact

Modified Confidentiality (MVC)

Modified Integrity (MVI)

Modified Availability (MVA)

Modified Subsequent System Impact

Modified Confidentiality (MSC)

Modified Integrity (MSI)

Modified Availability (MSA)

Supplemental Metrics (Optional)

Provide additional, contextual information that does not modify the final CVSS-BTE score, but communicates extra characteristics of the vulnerability to consumers.

Safety (S)

Automatable (AU)

Recovery (R)

Value Density (V)

Vulnerability Response Effort (RE)

Provider Urgency (U)

About CVSS v4.0

CVSS v4.0 is the latest version of the Common Vulnerability Scoring System, published by FIRST in November 2023. It introduces several significant changes over CVSS v3.1.

Key changes from CVSS v3.1

New base metric — Attack Requirements (AT): distinct from Attack Complexity, captures prerequisite deployment / execution conditions.
User Interaction (UI) expanded into three values: None, Passive, Active.
Scope removed and replaced by separate impact metrics for the Vulnerable System (VC/VI/VA) and Subsequent System(s) (SC/SI/SA).
Temporal renamed to Threat with a single simplified metric: Exploit Maturity (E). RL and RC have been removed.
Environmental Modified base covers all new base metrics. MSI/MSA add a "Safety (S)" value.
New Supplemental metric group: Safety (S), Automatable (AU), Recovery (R), Value Density (V), Response Effort (RE), Provider Urgency (U). These do not change the numeric score.
Nomenclature: scores are now labelled CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE depending on which metric groups are present.
New scoring algorithm based on macrovectors and interpolation, rather than the v3.1 closed-form formula.

References

The scoring engine on this page is a direct port of the official FIRST CVSS v4.0 JavaScript reference implementation. The lookup tables, max-severity tables and macrovector logic are embedded verbatim and the math has been validated against published reference vectors.

Import Vector String

Paste a CVSS v4.0 vector string

CVSS v4.0 Severity Ratings

None

Score: 0.0

Low

Score: 0.1 - 3.9

Medium

Score: 4.0 - 6.9

High

Score: 7.0 - 8.9

Critical

Score: 9.0 - 10.0