CVSS Calculator: Score a Vulnerability From Its 3.1 Vector

The Common Vulnerability Scoring System (CVSS) turns a vulnerability into a number from 0 to 10, and that number decides how fast you have to act. Choose the eight base metrics below, or paste a vector string from a scan report or advisory, and the calculator works out the CVSS 3.1 base score and severity. The score that matters most for a UK small business is 7.0: Cyber Essentials treats anything rated 7.0 or above as high or critical, and expects the fix to be applied within 14 days of release.

What the eight base metrics mean

CVSS splits a vulnerability into two halves. The exploitability metrics describe how easy it is to attack: whether it can be reached over the internet (Attack Vector), whether the attacker needs special conditions (Attack Complexity), an account (Privileges Required) or a victim's help (User Interaction). The impact metrics describe what the attacker gets: loss of Confidentiality, Integrity and Availability. Scope records whether the damage can spread beyond the vulnerable component, for example a flaw in a hypervisor that reaches the virtual machines running on it.

The worst case on paper is a network-reachable flaw, low complexity, no login, no user action, with high impact on all three. That is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8, and it is the vector you will see on many of the remote code execution bugs in firewalls and VPN appliances that attackers race to exploit.

The severity bands

CVSS 3.1 maps the score to a rating: 0.0 is None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical. Vulnerability scanners, the US National Vulnerability Database and most vendor advisories use these same bands, so the label on your scan report should match the one above.

Why 7.0 is the line for Cyber Essentials

The Cyber Essentials requirements say software must be updated within 14 days of a fix being released where the vendor describes it as critical or high risk, or where it carries a CVSS v3 base score of 7 or above. If the vendor gives no rating, the 14-day rule applies anyway. Unpatched software is a common reason for failing an assessment. Use our Cyber Essentials patch deadline calculator to work out the exact date from the release day.

Base score is not the whole picture

The base score describes the vulnerability in general, not in your network. A 9.8 on a server that is switched off and unreachable matters less than a 7.5 on your internet-facing VPN. Two things are worth checking alongside the number: whether the flaw is on the US CISA Known Exploited Vulnerabilities list, which means attackers are already using it, and whether the affected system faces the internet. CVSS 4.0 was published in late 2023 and some advisories now quote it, but the two versions score differently, so do not compare a 4.0 score directly with a 3.1 one. This calculator uses the 3.1 formula from the FIRST specification.

Cyber insurers ask about patching on proposal forms for the same reason: unpatched, internet-facing systems are a common way into a business. Our cyber insurance readiness checklist covers what else they check.