CVSS 3.1 Base Score Calculator

Pick the eight base metrics and the score updates as you go. The vector string below is the canonical form you can paste into a ticket or an advisory.

What the number is doing

The base score is a function of eight inputs and nothing else. It has no idea whether the affected system is a lab box or your payment gateway, whether a working exploit exists, or whether the service is reachable from the internet in your particular deployment. It measures the intrinsic characteristics of the vulnerability, deliberately holding your environment constant.

That design choice is what makes scores comparable between vendors, and it is also why a 9.8 on an isolated internal host can reasonably sit below a 6.5 on something exposed and business-critical.

Where the score comes from

Two sub-scores combine. Impact is driven by the confidentiality, integrity and availability metrics, passed through a formula that produces diminishing returns — moving one metric from None to High matters far more than moving the third. Exploitability multiplies attack vector, complexity, privileges and user interaction, which is why a network-reachable, no-privileges, no-interaction flaw dominates the top of the range.

Scope is the metric people get wrong most often. It does not ask how bad the damage is. It asks whether the vulnerable component and the impacted component are the same security authority. A hypervisor escape changes scope. A SQL injection that reads the database the application already owns does not.

Using it honestly

A base score is a triage input, not a priority. Two adjustments do most of the work in practice: whether an exploit is publicly available and being used, and what the asset actually does. A published exploit turns a theoretical medium into an urgent one; an air-gapped test system turns a critical into next quarter’s patch cycle.

Teams that rank purely by base score end up patching loudly-scored issues on systems nobody can reach while a medium-scored bug sits on the edge of the network. The score is where triage starts.