CVSS 4.0 calculator (and 3.1) that writes the finding
Score a vulnerability in CVSS 3.1 or 4.0, add a business-risk rating, and copy report-ready severity text with a written justification. No signup. From the team behind the Cairn pentest reporting platform.
Paste this straight into the finding.
Severity: Critical (CVSS 4.0 base 10.0) CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Justification: The flaw is reachable over the network with no privileges and no user interaction, fully compromising confidentiality, integrity and availability.
Which version should I use?
CVSS 3.1 is still the most widely required version and what most clients and compliance frameworks expect today. CVSS 4.0 is the current standard, with a finer model that separates the impact on the vulnerable system from downstream (“subsequent”) systems and adds an attack-requirements metric. If your client hasn’t specified, quote 3.1 and keep 4.0 alongside — this tool gives you both from the same finding.
What changed in CVSS 4.0
CVSS 4.0 is the current version of the standard. If you have only ever scored in 3.1, four changes matter when you pick up the 4.0 metrics:
- Scope is gone. Where 3.1 had a single Scope flag and one set of impact metrics, 4.0 splits impact in two: the vulnerable system(VC, VI, VA) and any subsequent system (SC, SI, SA) reached through it. You now say what breaks and where, rather than flagging that a boundary was crossed.
- Attack Requirements (AT) is new. 3.1 folded environmental preconditions into Attack Complexity. 4.0 separates them: AC is about the attacker’s effort, AT is about conditions outside their control, such as a race window or a specific configuration.
- User Interaction is graded. 3.1 offered None or Required. 4.0 distinguishes Passive interaction from Active, so a drive-by no longer scores the same as a victim who has to complete a form.
- The score is named for what it covers. A base-only score is CVSS-B; adding threat metrics gives CVSS-BT, environmental gives CVSS-BE, and both gives CVSS-BTE. The calculator above produces CVSS-B, which is what a report quotes unless the client has asked for more.
CVSS 4.0 also adds supplemental metrics (Safety, Automatable, Recovery, Value Density, Response Effort, Provider Urgency). They carry no weight in the score and are informational only, so they are deliberately left out of this tool.
How to read your CVSS score
Both CVSS 3.1 and CVSS 4.0 produce a base score from 0.0 to 10.0, and both map that number to the same five qualitative ratings, so the calculator above shows the severity band alongside the score:
- None: 0.0
- Low: 0.1 to 3.9
- Medium: 4.0 to 6.9
- High: 7.0 to 8.9
- Critical: 9.0 to 10.0
The base score is the intrinsic, environment-independent severity of the vulnerability. It deliberately says nothing about how exploited it is in the wild or how exposed the affected system is in your client’s environment. That is what CVSS temporal and environmental metrics, and the Likelihood x Impact business-risk rating above, are for. Quote the base score for a consistent, defensible number, and layer the business risk on top when the report needs to speak to impact rather than raw technical severity.
What is CVSS?
The Common Vulnerability Scoring System is the industry standard for rating the severity of a security vulnerability from 0.0 to 10.0. This tool computes the base score for both CVSS 3.1 and CVSS 4.0 from their base metrics.
What is the difference between CVSS 3.1 and 4.0?
CVSS 4.0 is the current standard. It refines the model: it separates the impact on the vulnerable system (VC/VI/VA) from downstream subsequent systems (SC/SI/SA), adds an Attack Requirements metric, and expands User Interaction. CVSS 3.1 is still the most widely required version and what most compliance frameworks expect today, so this tool gives you both.
How do I calculate a CVSS 4.0 score?
Pick a value for each of the eleven CVSS 4.0 base metrics: Attack Vector, Attack Complexity, Attack Requirements, Privileges Required and User Interaction describe how the flaw is reached, and the six impact metrics describe the effect on the vulnerable system (VC, VI, VA) and on any subsequent system (SC, SI, SA). The calculator above builds the CVSS:4.0 vector string and computes the base score as you click, so you can copy both straight into a finding.
Is CVSS 4.0 replacing CVSS 3.1?
CVSS 4.0 is the current version of the standard and is what FIRST maintains going forward, but adoption is gradual. Many clients, scanners and compliance frameworks still expect 3.1, so in practice most reports quote 3.1 today and add 4.0 alongside. This tool produces both from the same finding so you do not have to choose.
Can I add a business risk rating?
Yes. CVSS is technical severity; most reports also carry a business risk from a Likelihood x Impact matrix. Toggle it on, pick a cell, and the report block includes both the CVSS score and the risk rating.
What do the severity ratings mean?
Both versions map the numeric score to a rating: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0).
Does this calculate temporal and environmental scores?
This free tool covers the base score plus an optional business-risk rating, which is what most reports quote. Cairn’s Report module has the full calculator built in — 3.1 and 4.0, base, temporal and environmental — and auto-scores findings across an entire report.