Tools / Assess

CVSS v3.1 Calculator

Assess technical severity by building a base vector, then use exploitation, exposure, and source evidence before prioritizing work.

Disputed CVSS guidance

Tool outcome

Assess CVSS base severity

Input: CVSS v3.1 metric choices. Output: a base vector, score, and severity. This browser tool does not establish local impact, exploitability, or remediation priority.

Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Integrity Availability

Score output

Choose the metrics to generate the base vector and score.

Interactive Example

See why one metric changes the story

Disputed CVSS guidance

Example vector

Network issue with no privileges required

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Try changing User Interaction from None to Required in the calculator above. The score changes because exploitation now depends on a user action.

Prioritization context

CVSS is not the whole decision

CVSSTechnical severity of the vulnerability characteristics.

EPSSProbability-style exploitation signal, not local impact proof.

CISA KEVKnown exploited catalog signal that often raises urgency.