CVSS v3.1 Base Calculator

Eight choices, no inferred answers

Choose Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity and Availability. The form builds the standard vector from those choices. If you already have a v3.1 Base vector, import it instead and review the populated selections. Missing or repeated metrics and unsupported groups are rejected rather than assigned a score.

Rounding is part of the calculation

The calculation follows the v3.1 Base equations, including the changed-Scope privileges weights. It uses the integer Roundup procedure in FIRST Appendix A to avoid an extra tenth caused by floating-point noise. It does not calculate Temporal or Environmental scores, and it must not be labelled CVSS v4.0.

A severity label is not business risk

The sample produces a 9.8 Critical Base score for the metrics supplied. That label describes the CVSS severity band. Asset importance, actual exposure and compensating controls still need separate consideration. The tool does not look up a CVE, establish exploitation or recommend an incident priority.

Record why each value applies

Before sharing a score, explain the attack conditions and the security authority affected by Scope. Revisit assumptions when evidence changes. Copy and download include your vector and calculated values, not a validation of your underlying assessment.

References

• FIRST CVSS v3.1 specification and rounding
• FIRST worked v3.1 examples

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• Security Report Builder
• Self-Reported Security Checklist
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.