CVSS 4.0 calculator
Score a vulnerability with the current CVSS standard. Set the base metrics — plus optional threat and environmental context — for a v4.0 score, its severity, and a shareable vector string. The scoring follows the MacroVector method in the FIRST specification and runs entirely in your browser.
Need CVSS 3.1 instead? Use the 3.1 calculator →
Base Metrics
Intrinsic, unchanging characteristics of the vulnerability. All are required.
Scoring follows the MacroVector method in the FIRST CVSS v4.0 specification. Everything runs in your browser — nothing you enter leaves this page.
CVSS severity ratings
CVSS 4.0 uses the same qualitative severity bands as 3.1, so a numeric score maps to the familiar None-to-Critical scale.
| Severity | Score range |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
CVSS 4.0 questions, answered
What is new in CVSS 4.0?
CVSS 4.0 splits impact into the Vulnerable System and Subsequent Systems (replacing the old Scope metric), adds an Attack Requirements metric, renames Exploit Code Maturity to Exploit Maturity, and folds in supplemental and environmental context. It is scored with a MacroVector method rather than the single formula used in 3.1.
How is a CVSS 4.0 score calculated?
The metrics are grouped into equivalence classes (EQs) that form a MacroVector, which maps to a base score. The final score interpolates between that MacroVector and the next lower one according to how severe the specific vector is within its class. This calculator follows that method.
Is a 3.1 vector the same as a 4.0 vector?
No. The metric sets and scoring methods differ, so a CVSS 3.1 vector and a CVSS 4.0 vector are not interchangeable and will generally produce different scores. Use the version that matches the record you are working from.
Do the threat and environmental metrics change the score?
Yes. Threat (Exploit Maturity) and environmental metrics adjust the base score to reflect how the threat is evolving and how important confidentiality, integrity, or availability are in your environment. Leaving them as Not Defined uses the worst-case assumption.
How accurate is this calculator?
It follows the MacroVector method in the FIRST CVSS v4.0 specification and is based on FIRST’s reference implementation. Check any score that matters against FIRST’s own calculator. Scoring runs entirely in your browser.
How to label a CVSS 4.0 score
A v4.0 number on its own does not say which metrics went into it. FIRST asks you to label it:
“CVSS-B Base metrics. CVSS-BE Base and Environmental metrics. CVSS-BT Base and Threat metrics. CVSS-BTE Base, Threat, Environmental metrics.”
So a score from the base metrics alone is CVSS-B, and one that also includes exploit maturity from the threat group is CVSS-BT. Say which when you quote a number in a report.
What to fill in first
- Base metrics describe the flaw and do not change with time. Start here.
- Attack Requirements captures conditions of the target that must exist for the attack to work, separate from how hard the attack is.
- Threat (exploit maturity) and Environmental metrics are for the person using the score. The base score stands without them.
Comparing with an older rating? The CVSS 3.1 calculator scores the same flaw with the previous standard, and the two numbers will not match exactly.
Related tools and guides
Found something serious?
A score tells you how bad a flaw is in theory. A penetration test tells you what an attacker could actually do with it in your environment. Compare UK penetration testing companies in our directory.
Browse the directory