CVD Portal
← All tools
Free Tool

CVSS 4.0 Calculator

Score a vulnerability with CVSS v4.0 using Base, Threat, and Environmental metrics. The MacroVector equivalence class displays alongside the vector so the result can be verified against the specification. A vector can be supplied in the URL to share or re-check a score.

Last updated 29 August 2026

Key takeaways

  1. CVSS v4.0 scores vulnerabilities by mapping metric vectors to MacroVector equivalence classes rather than using a closed-form formula.
  2. A complete CVSS 4.0 evaluation incorporates Base, Threat, and Environmental metric groups to calculate final vulnerability severity.
  3. Article 14 reporting obligations depend on factual evidence of active exploitation rather than a specific CVSS score threshold.
  4. A standard CVSS 4.0 vector string requires eleven mandatory base metrics prefixed by the specification identifier.

Frequently asked

Is this the official CVSS 4.0 calculator?+

No. The official calculator is published by FIRST.ORG at first.org/cvss/calculator/4.0 and is the authority. This calculator's scoring is a TypeScript port of the FIRST.ORG reference implementation (cvss_score.js, BSD-2-Clause), so it should agree with the official calculator for any vector. If you find a vector where it does not, that is a bug worth reporting to us.

Why does CVSS 4.0 have no formula?+

CVSS v4.0 does not score a vector with a closed-form equation. Each vector belongs to a MacroVector equivalence class. The score is interpolated toward the next-lower class based on distance from the most severe vectors in that class. This page shows the MacroVector next to the score so you can check the arithmetic by hand.

Do the Threat and Environmental metrics change the score?+

Yes, when you set them. Left at Not Defined they do not, which is what the specification requires. Exploit Maturity feeds the EQ5 MacroVector digit, and the security requirements and modified base metrics substitute into the scoring walk in place of the base values. A calculator that only implements Base is not a CVSS 4.0 calculator, so all three metric groups are exposed here.

Should I use CVSS 3.1 or 4.0 for CRA Article 14?+

Article 14 does not name a scoring system, so neither is mandated. What matters is whether a vulnerability is actively exploited, which is a factual question rather than a scoring one. CVSS is useful for prioritisation and for describing severity in a report consistently. Many databases still publish 3.1, so recording both is often the practical answer. A 3.1 calculator is available at /tools/cvss-calculator.

Can I link to a specific score?+

Yes. Append ?vector=CVSS:4.0/... to this page's URL and it opens with those metrics selected. The vector must carry the CVSS:4.0/ prefix and all eleven base metrics, otherwise the page says so rather than silently scoring something else.

Other free CRA tools

CVSS CalculatorCalculate CVSS 3.1 base scores for vulnerability severity assessment. Includes guidance on whether the score triggers Article 14 notification obligations under the EU Cyber Resilience Act.Article 14 Deadline CalculatorEnter the date and time you became aware of an actively exploited vulnerability or severe security incident. Get your exact Article 14 notification deadlines for ENISA reporting.CSAF 2.0 Advisory ValidatorPaste your CSAF 2.0 JSON advisory and instantly validate the structure against the OASIS CSAF 2.0 schema. Identifies missing mandatory fields, invalid values, and flags common issues that would cause rejection by automated consumers and ENISA tooling.

Ready to automate your CVD programme?

CVD Portal integrates all these tools and handles your Article 13 and 14 obligations automatically.

Start your free portal →