CVSS 4.0 Calculator

VULNERABILITY SCORING SYSTEM

0.0

Undefined

01 / EXPLOITABILITY

Exploitability0/5

How a vulnerability can be exploited.

Attack Vector AVWhere an attacker connects

Unselected

Attack Complexity ACConditions to bypass

Unselected

Attack Requirements ATConditions that must exist

Unselected

Privileges Required PRAccess needed beforehand

Unselected

User Interaction UIHuman involvement

Unselected

02 / VULNERABLE SYSTEM

Direct impact0/3

Consequences to the affected system.

Confidentiality VCData exposure

Unselected

Integrity VIUnauthorised changes

Unselected

Availability VAService disruption

Unselected

03 / SUBSEQUENT SYSTEM

Downstream impact0/3

Consequences beyond the affected system.

Confidentiality SCOther systems’ data

Unselected

Integrity SIChanges to other systems

Unselected

Availability SADisruption to other systems

Unselected

ENVIRONMENT / CRITICALITY

Requirements0/3

What a loss means in your environment.

Confidentiality Requirement CRImportance of confidentiality in your environment.

Unselected

Integrity Requirement IRImportance of integrity in your environment.

Unselected

Availability Requirement ARImportance of availability in your environment.

Unselected

ENVIRONMENT / MODIFIED BASE

Local exploitability0/5

Override Base values only when local evidence supports it.

Modified Attack Vector MAVOverride AV only when evidence about this environment supports it.

Unselected

Modified Attack Complexity MACOverride AC only when evidence about this environment supports it.

Unselected

Modified Attack Requirements MATOverride AT only when evidence about this environment supports it.

Unselected

Modified Privileges Required MPROverride PR only when evidence about this environment supports it.

Unselected

Modified User Interaction MUIOverride UI only when evidence about this environment supports it.

Unselected

ENVIRONMENT / MODIFIED IMPACT

Local impact0/6

Vulnerable and subsequent systems, including Safety.

Modified Vulnerable Confidentiality MVCOverride VC only when evidence about this environment supports it.

Unselected

Modified Vulnerable Integrity MVIOverride VI only when evidence about this environment supports it.

Unselected

Modified Vulnerable Availability MVAOverride VA only when evidence about this environment supports it.

Unselected

Modified Subsequent Confidentiality MSCOverride SC only when evidence about this environment supports it.

Unselected

Modified Subsequent Integrity MSIOverride SI only when evidence about this environment supports it.

Unselected

Modified Subsequent Availability MSAOverride SA only when evidence about this environment supports it.

Unselected

CVSS 4.0 Calculatorv1.1.3

Clarity in every score.

CVSS 4.0 Calculator turns your vulnerability assessment into a severity score and a shareable vector. Assess Base metrics, add Threat and Environmental context, and record optional Supplemental information. It runs on your device and works offline after the hosted app has loaded once.

Version: 1.1.3
Build: 2026-10-21 23:03 Europe/Dublin
Made by: neodesigner.com, Cork, Ireland
Contact: info@neodesigner.com

The CVSS Calculator Handbook

Open the Handbook

Getting started

Start with Configure. It opens the first Base card below the fixed header. Group buttons switch Base, Threat, Environmental and Supplemental and scroll to the first incomplete card with the same top clearance.
Every metric starts unselected. Pink selected/total counters show explicit answers; the total followed by ✓ means a card or group is complete. These counters show progress, not severity. Tap a selected answer again to clear it.
Completing a card closes it, opens the next incomplete card in the same group and scrolls there. You can reopen cards to review or change answers. When every card in the group is complete, Go to top appears below the last card and returns to the dial.
The dial starts at 0.0 with a grey ring, Configure and Undefined. After the first choice, normal severity and score-label styling returns. All 11 Base answers are required before calculation or vector export; until then 0.0 is a placeholder. Optional groups can remain incomplete.
Open Vector, the bottom pill beside the dial, for Copy vector, Reset and Load a vector. Reset clears all 32 answers. Apply vector validates all required Base values, metric order and value codes before changing your assessment; invalid input leaves it intact.
Close modals with × or their Close button, Escape, browser Back or a click outside. Background content dims by 25% while a modal is open. Copy is available only with complete Base answers.
Tap the version to open About. Install and Back are in its fixed header. Browser Back or Escape also returns without losing choices. After one complete online load the hosted app works offline. Normal reload starts empty; automatic updates preserve choices, open cards, search, vector drafts and an open Vector modal.

Metric groups and defaults

Base describes the vulnerability itself. All 11 Base metrics must be explicitly selected before scoring.

Threat records current exploitation evidence. An unselected Exploit Maturity value uses the Attacked (A) scoring default.

Environmental records local requirements and evidence-based Base overrides. Unselected requirements CR, IR and AR use High (H); unselected modified values follow the corresponding Base choice, including later changes.

Supplemental records context only. Its six values do not change the calculated score or score-label suffix.

Unselected optional values retain the standard X semantics internally. Inherited or default values do not increase completion counts. Optional groups can remain incomplete. Environmental Safety in MSI/MSA affects the score; Supplemental Safety does not.

Attack Vector (AV)

Where the attacker must be to reach the flaw.

Network (N): Reachable across a network, potentially over the Internet.
Adjacent (A): Restricted to a nearby or logically adjacent network.
Local (L): Requires local read, write or execute access, or a user opening attacker-controlled content.
Physical (P): Requires touching or manipulating the device.

Attack Complexity (AC)

Security protections the attacker must overcome. This is separate from timing or deployment conditions.

Low (L): No target-specific security bypass is needed.
High (H): A protection must be bypassed, such as exploit mitigations or a target-specific secret.

Attack Requirements (AT)

Conditions in deployment or execution that make the attack possible.

None (N): No special deployment or execution condition is required.
Present (P): A condition such as winning a race or being on the network path is required.

Privileges Required (PR)

Access the attacker needs before exploitation, rather than access gained by exploiting the flaw.

None (N): No prior authorization is required.
Low (L): Basic user permissions or limited access is required.
High (H): Administrative or similarly powerful permissions are required.

User Interaction (UI)

Whether a person other than the attacker must participate.

None (N): No other person needs to act.
Passive (P): Limited or involuntary interaction is enough; the user need not defeat protections.
Active (A): Specific conscious actions or actions that bypass protections are needed.

Confidentiality (VC)

Disclosure of information held by the vulnerable system.

High (H): All information is exposed, or a smaller disclosure has a direct, serious consequence.
Low (L): Disclosure is limited and does not cause a direct, serious loss.
None (N): No confidentiality loss in the vulnerable system.

Integrity (VI)

Unauthorized changes to information or loss of its trustworthiness in the vulnerable system.

High (H): Protection is lost completely, or a modification has a direct, serious consequence.
Low (L): Changes are limited and do not have a direct, serious consequence.
None (N): No integrity loss in the vulnerable system.

Availability (VA)

Loss of access to the vulnerable system or its services.

High (H): Service is denied completely, or a partial loss has a direct, serious consequence.
Low (L): Performance or access is reduced without a direct, serious consequence.
None (N): No availability loss in the vulnerable system.

Confidentiality (SC)

Information disclosure in a separate system affected by exploiting the vulnerable system.

High (H): All information is exposed, or limited disclosure has a direct, serious consequence.
Low (L): Disclosure in the other system is limited and not directly serious.
None (N): No confidentiality loss beyond the vulnerable system.

Integrity (SI)

Unauthorized changes or loss of trustworthiness in a separate affected system.

High (H): Protection is lost completely, or a modification has a direct, serious consequence.
Low (L): Changes in the other system are limited and not directly serious.
None (N): No integrity loss beyond the vulnerable system.

Availability (SA)

Loss of access to a separate affected system or its services.

High (H): Service is denied completely, or partial loss has a direct, serious consequence.
Low (L): The other system has reduced access or performance without a direct, serious consequence.
None (N): No availability loss beyond the vulnerable system.

Exploit Maturity (E)

Current evidence that attackers can exploit this vulnerability.

Not defined (X): This metric has not been assessed.
Attacked (A): Attacks have been reported, or practical exploitation is available.
Proof of concept (P): A proof of concept exists; successful attacks have not been reported.
Unreported (U): No public proof of concept or reported exploitation is known. This does not prove exploitation is impossible.

Confidentiality Requirement (CR)

Importance of confidentiality in your environment.

Not defined (X): Use the worst-case High requirement.
High (H): A loss would have a catastrophic adverse effect.
Medium (M): A loss would have a serious adverse effect.
Low (L): A loss would have a limited adverse effect.

Integrity Requirement (IR)

Importance of integrity in your environment.

Not defined (X): Use the worst-case High requirement.
High (H): A loss would have a catastrophic adverse effect.
Medium (M): A loss would have a serious adverse effect.
Low (L): A loss would have a limited adverse effect.

Availability Requirement (AR)

Importance of availability in your environment.

Not defined (X): Use the worst-case High requirement.
High (H): A loss would have a catastrophic adverse effect.
Medium (M): A loss would have a serious adverse effect.
Low (L): A loss would have a limited adverse effect.

Modified Attack Vector (MAV)

Override AV only when evidence about this environment supports it.

Use Base (X): Use the corresponding Base value; no local override is applied.
Network (N): The vulnerable component is reachable over a network.
Adjacent (A): Access requires a nearby or logically adjacent network.
Local (L): The attack needs local access or local execution.
Physical (P): Physical interaction with the device is required.