Vulnerability Score Calculator
CVSS scoring & risk assessment • 2026 edition
CVSS Score Formula:
Show Calculator\( \text{Base Score} = \text{RoundUp}(\min((\text{Impact} \times \text{Exploitability}), 10)) \)
Where:
- \( \text{Impact} = 1 - [(1 - \text{ConfImpact}) \times (1 - \text{IntegImpact}) \times (1 - \text{AvailImpact})] \)
- \( \text{Exploitability} = 8.6 \times \text{AccessVector} \times \text{AccessComplexity} \times \text{Authentication} \)
- \( \text{Temporal Score} = \text{Base Score} \times \text{Temporal Modifiers} \)
- \( \text{Environmental Score} = [\text{Temporal Score} + (10 - \text{Temporal Score}) \times \text{Environmental Modifiers}] \)
CVSS v3.1 Base Metrics:
- Attack Vector (AV): Network, Adjacent, Local, Physical
- Attack Complexity (AC): Low, High
- Privileges Required (PR): None, Low, High
- User Interaction (UI): None, Required
- Scope (S): Unchanged, Changed
- Impact Metrics: Confidentiality, Integrity, Availability
Example: For a vulnerability with AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H:
\( \text{Base Score} = \text{RoundUp}(\min((6.51 \times 2.8), 10)) = 9.8 \) (Critical)
This represents a critical vulnerability with maximum impact and easy exploitation.
Vulnerability Metrics
Advanced Options
Risk Assessment
| Metric | Value | Score |
|---|---|---|
| Attack Vector | Network | 0.85 |
| Attack Complexity | Low | 0.77 |
| Privileges Required | None | 0.85 |
Patch immediately - critical vulnerability
Implement network segmentation
Enhanced monitoring required
Comprehensive Vulnerability Scoring Guide
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities. CVSS provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. This score can then be translated into a qualitative representation (Low, Medium, High, Critical) to help organizations properly assess and prioritize their vulnerability management processes.
The base score calculation follows this structure:
Where:
- \( \text{Impact} = 1 - [(1 - \text{ConfImpact}) \times (1 - \text{IntegImpact}) \times (1 - \text{AvailImpact})] \)
- \( \text{Exploitability} = 8.6 \times \text{AccessVector} \times \text{AccessComplexity} \times \text{Authentication} \)
CVSS scores are categorized as follows:
- None: 0.0 (No security impact)
- Low: 0.1 - 3.9 (Minimal security impact)
- Medium: 4.0 - 6.9 (Moderate security impact)
- High: 7.0 - 8.9 (Significant security impact)
- Critical: 9.0 - 10.0 (Severe security impact)
- Prioritization: Focus on critical and high severity vulnerabilities
- Patching: Apply patches based on CVSS scores and business impact
- Monitoring: Increase monitoring for high-risk vulnerabilities
- Mitigation: Implement compensating controls when patches aren't available
- Documentation: Maintain records of vulnerability assessments
Vulnerability Fundamentals
Common Vulnerability Scoring System for risk assessment.
\( \text{Base Score} = \text{RoundUp}(\min((\text{Impact} \times \text{Exploitability}), 10)) \)
Where Impact and Exploitability calculated from metrics.
- Higher scores indicate more severe vulnerabilities
- Focus on critical and high priority items
- Consider temporal and environmental factors
Security Planning
Strategic approach to vulnerability management and prioritization.
- Identify vulnerabilities
- Calculate CVSS scores
- Prioritize based on severity
- Plan remediation
- Business impact
- Resource availability
- Timeline constraints
- Regulatory requirements
Vulnerability Scoring Learning Quiz
Which CVSS metric category includes characteristics that are intrinsic to a vulnerability and constant over time?
The answer is B) Base Metrics. Base metrics are the core characteristics of a vulnerability that are intrinsic to its nature and remain constant over time and across different user environments. These include Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and Impact metrics. Temporal metrics change over time, and environmental metrics depend on specific user environments.
Students must understand the three-tier structure of CVSS metrics. Base metrics represent the inherent characteristics of a vulnerability. Temporal metrics reflect how the vulnerability changes over time (like exploit availability). Environmental metrics account for specific organizational factors. This hierarchical approach allows for standardized scoring while allowing customization for specific environments.
Base Metrics: Intrinsic vulnerability characteristics that are constant
Temporal Metrics: Characteristics that change over time
Environmental Metrics: Organization-specific characteristics
• Base metrics are fundamental to the vulnerability
• Temporal metrics reflect evolving threat landscape
• Environmental metrics customize for specific contexts
• Base = Fundamental characteristics
• Temporal = Time-dependent factors
• Environmental = Context-specific factors
• Confusing the different metric categories
• Not understanding the constant nature of base metrics
• Thinking all metrics apply universally
Calculate the base CVSS score for a vulnerability with: Attack Vector = Network (0.85), Attack Complexity = Low (0.77), Privileges Required = None (0.85), User Interaction = None (0.85), Scope = Unchanged, Confidentiality Impact = High (0.56), Integrity Impact = High (0.56), Availability Impact = High (0.56). Show your work.
First, calculate the Impact Sub-Score:
Since Scope is Unchanged, Impact Sub-Score = 6.42 × (1 - (1 - 0.56) × (1 - 0.56) × (1 - 0.56)) = 6.42 × (1 - (0.44 × 0.44 × 0.44)) = 6.42 × (1 - 0.085) = 6.42 × 0.915 = 5.87
Next, calculate the Exploitability Sub-Score:
Exploitability = 8.6 × 0.85 × 0.77 × 0.85 = 8.6 × 0.558 = 4.79
Finally, calculate the Base Score:
Base Score = RoundUp(min((5.87 + 4.79), 10)) = RoundUp(min(10.66, 10)) = 10.0
However, since Impact is > 0 and Scope is Unchanged, we use: Base Score = RoundUp(min(5.87 × 4.79, 10)) = RoundUp(min(28.12, 10)) = 10.0
Wait, let me recalculate using the correct formula:
Impact = 1 - [(1 - 0.56) × (1 - 0.56) × (1 - 0.56)] = 1 - (0.44³) = 1 - 0.085 = 0.915
Exploitability = 8.6 × 0.85 × 0.77 × 0.85 = 4.79
Base Score = RoundUp(min(6.42 × 0.915, 10)) = RoundUp(min(5.87, 10)) = 5.9
Actually, for Scope=Unchanged: Base Score = RoundUp(min(0.621 × 0.915 + 3.25 × (1 - 0.915)¹.²⁶, 10)) × 1.44 = 9.8
This calculation demonstrates the complexity of CVSS scoring. The formula varies based on the Scope metric. When Scope is Unchanged, the calculation is different than when Scope is Changed. The score is bounded at 10.0 and rounded up to one decimal place. This shows why automated tools are typically used for CVSS calculations.
Impact Sub-Score: Measures the potential damage of a vulnerability
Exploitability Sub-Score: Measures how easy the vulnerability is to exploit
Base Score: Final CVSS score combining impact and exploitability
• Formula differs based on Scope metric
• Score is rounded up to 1 decimal place
• Maximum score is 10.0
• Use automated tools for complex calculations
• Remember Scope affects the formula
• Impact and Exploitability are multiplied differently
• Forgetting the Scope parameter affects the formula
• Incorrect rounding (should be round up)
• Not understanding the multiplication factors
An organization has discovered three vulnerabilities in their systems: A) CVSS score 9.1 (Critical), B) CVSS score 7.8 (High), and C) CVSS score 6.5 (Medium). The security team has limited resources and can only address one vulnerability immediately. Based on CVSS scoring, which vulnerability should be addressed first and why? If the organization has a policy to patch all Critical and High vulnerabilities within 72 hours, calculate the total time required if Critical vulnerabilities take 4 hours to patch and High vulnerabilities take 2 hours to patch.
Vulnerability A (CVSS 9.1 - Critical) should be addressed first because:
- It has the highest CVSS score (9.1)
- It falls in the Critical severity range (9.0-10.0)
- It poses the highest risk to the organization
- It likely has the highest potential impact
Following the policy to patch Critical and High vulnerabilities within 72 hours:
- Critical vulnerabilities (Score A): 4 hours
- High vulnerabilities (Score B): 2 hours
- Total time required: 4 + 2 = 6 hours
The organization should be able to address both Critical and High vulnerabilities within the 72-hour window with only 6 hours of actual patching time required.
This example demonstrates how CVSS scores drive prioritization decisions. Critical vulnerabilities (9.0-10.0) take precedence over High (7.0-8.9) and Medium (4.0-6.9) vulnerabilities. Organizations typically establish SLAs based on CVSS severity ranges to ensure consistent and timely response to security issues. The time calculation shows that actual patching time is often much less than the policy window.
Service Level Agreement (SLA): Timeframe for addressing vulnerabilities
Security Policy: Organizational rules for vulnerability management
Prioritization: Ranking vulnerabilities by severity and risk
• Critical vulnerabilities should be patched immediately
• Policies typically define timeframes based on severity
• Higher CVSS scores get higher priority
• Establish clear SLAs by CVSS ranges
• Focus on highest severity first
• Consider business impact alongside CVSS
• Not prioritizing by severity
• Ignoring established patching policies
• Focusing on quantity rather than risk
An e-commerce company has identified a vulnerability with CVSS 8.2 (High) affecting their payment processing system. The system processes $10 million in transactions daily. If the vulnerability is exploited, the estimated financial impact could be 10% of daily revenue plus $500,000 in regulatory fines. Calculate the total potential loss from this vulnerability. Then, if patching costs $50,000 and takes 8 hours, calculate the ROI of addressing this vulnerability immediately.
Potential Loss Calculation:
- Daily transaction volume: $10,000,000
- Revenue impact: 10% of $10,000,000 = $1,000,000
- Regulatory fines: $500,000
- Total potential loss: $1,000,000 + $500,000 = $1,500,000
ROI Calculation:
- Cost of addressing vulnerability: $50,000
- Potential loss prevented: $1,500,000
- Net benefit: $1,500,000 - $50,000 = $1,450,000
- ROI: ($1,450,000 ÷ $50,000) × 100 = 2,900%
The ROI of addressing this High severity vulnerability immediately is 2,900%, making it a highly cost-effective security investment.
This example shows how business context amplifies the importance of vulnerability remediation. While CVSS provides technical severity, business impact analysis quantifies the actual financial risk. The 2,900% ROI demonstrates that even High severity vulnerabilities in critical systems justify immediate attention. This financial perspective helps security teams communicate risk to business stakeholders.
Business Impact: Financial consequences of a security incident
Return on Investment (ROI): Financial benefit relative to cost
Risk Quantification: Converting security risks to monetary values
• High CVSS scores in critical systems require immediate attention
• Financial impact often exceeds patching costs
• ROI calculations help justify security investments
• Calculate potential losses for critical systems
• Use financial metrics to communicate risk
• Consider regulatory and reputation costs
• Not considering business context in risk assessment
• Focusing only on technical severity
• Underestimating indirect costs of incidents
Which of the following correctly matches CVSS score ranges to their severity classifications?
The answer is B) 0.0-3.9: Low, 4.0-6.9: Medium, 7.0-8.9: High, 9.0-10.0: Critical. This is the official CVSS v3.1 severity classification. The ranges are standardized to ensure consistent interpretation of vulnerability scores across different organizations and security tools. This standardization allows for effective vulnerability management and prioritization processes.
Students must memorize the exact CVSS severity ranges as they are standardized. The ranges are not evenly distributed - there's a larger range for Medium (3.0-6.9) than for other categories. This reflects the reality that many vulnerabilities fall into the medium severity range. Understanding these ranges is crucial for proper vulnerability prioritization and reporting.
Severity Classification: Standardized ranges for CVSS scores
Standardization: Consistent interpretation across organizations
Prioritization Framework: Basis for vulnerability management
• Memorize the exact ranges
• Critical is 9.0-10.0
• Medium has the widest range
• Critical = 9-10 (memorize as "high numbers = high severity")
• Medium = 4-6.9 (largest range)
• Low = 0.1-3.9 (remember: zero is none, low is up to 3.9)
• Reversing the severity classifications
• Confusing the ranges
• Not remembering that 0.0 is "none" not "low"
FAQ
Q: How should organizations interpret CVSS scores when making patching decisions?
A: CVSS scores should guide but not solely determine patching decisions:
Critical (9.0-10.0): Apply patches immediately, typically within 24-72 hours. These vulnerabilities have the highest potential for damage and are often exploited in the wild.
High (7.0-8.9): Apply patches within 7 days. These require prompt attention and may need temporary mitigations if immediate patching isn't feasible.
Medium (4.0-6.9): Apply patches within 30 days. These can sometimes be scheduled with regular maintenance windows.
Low (0.1-3.9): Address during routine patching cycles, typically quarterly or semi-annually.
However, consider additional factors:
- Asset criticality: A medium vulnerability on a critical system may deserve priority
- Exploit availability: Active exploits in the wild require faster response
- Business impact: Vulnerabilities affecting revenue-generating systems
- Regulatory requirements: Compliance obligations may override CVSS
The goal is to balance risk reduction with operational stability.
Q: What's the difference between CVSS Base, Temporal, and Environmental scores?
A: CVSS uses three score types for comprehensive risk assessment:
Base Score: Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This is the core score that reflects the vulnerability's fundamental properties. It includes metrics like Attack Vector, Attack Complexity, Privileges Required, and Impact metrics.
Temporal Score: Refines the Base Score by incorporating factors that change over time but not across environments. These include Exploit Code Maturity (is there a working exploit?), Remediation Level (is a fix available?), and Report Confidence (how confident are we in the vulnerability report?).
Environmental Score: Adapts the Temporal Score to reflect the specific environment of the user. This allows organizations to customize scores based on their specific configuration, asset importance, and deployed countermeasures. Metrics include Confidentiality Requirement, Integrity Requirement, Availability Requirement, and Modified versions of Base metrics.
For example, a vulnerability might have a Base Score of 7.5 (High), but if a company has implemented compensating controls, the Environmental Score might be reduced to 4.2 (Medium), changing the priority for that specific organization.