CVSS v4.0 Reference

CVSS v4.0 is the current standard published by FIRST.Org. It replaces the binary Scope switch from v3.x with explicit impact metrics for both the Vulnerable System (VC, VI, VA) and Subsequent Systems (SC, SI, SA), separates prerequisite conditions into Attack Requirements (AT), refines User Interaction (UI) into three levels, and introduces Supplemental metrics alongside official score nomenclature (CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE).

Open the CVSS v4.0 Calculator.

Official Nomenclature

CVSS v4.0 requires indicating which metric groups contributed to a numeric score:

• CVSS-B: Base metrics only.
• CVSS-BT: Base + Threat metrics.
• CVSS-BE: Base + Environmental metrics.
• CVSS-BTE: Base + Threat + Environmental metrics.

Supplemental metrics (S, AU, R, V, RE, U) never change the numeric score or the nomenclature label. They are recorded in the canonical vector string to provide structured context for incident responders.

Base Metrics (11 Mandatory)

All 11 Base metrics must be specified before a CVSS v4.0 vector is valid.

Exploitability Metrics

Metric	Code	Values	Description
Attack Vector	AV	N (Network), A (Adjacent), L (Local), P (Physical)	Context by which vulnerability exploitation is possible.
Attack Complexity	AC	L (Low), H (High)	Effort required by the attacker to evade or circumvent defensive or security-enhancing technologies.
Attack Requirements	AT	N (None), P (Present)	Deployment and execution conditions or variables of the vulnerable system that enable the attack.
Privileges Required	PR	N (None), L (Low), H (High)	Level of privileges an attacker must possess prior to successfully exploiting the vulnerability.
User Interaction	UI	N (None), P (Passive), A (Active)	Whether exploitation requires participation from a human user other than the attacker.

Vulnerable System Impact Metrics

Metric	Code	Values
Vulnerable System Confidentiality	VC	H (High), L (Low), N (None)
Vulnerable System Integrity	VI	H (High), L (Low), N (None)
Vulnerable System Availability	VA	H (High), L (Low), N (None)

Subsequent System Impact Metrics

Metric	Code	Values
Subsequent System Confidentiality	SC	H (High), L (Low), N (None)
Subsequent System Integrity	SI	H (High), L (Low), N (None)
Subsequent System Availability	SA	H (High), L (Low), N (None)

Threat Metric (1 Optional)

Metric	Code	Values	Default (X)
Exploit Maturity	E	X (Not Defined), A (Attacked), P (Proof-of-Concept), U (Unreported)	When E:X is selected (or omitted), the calculator assumes A (Attacked) as the worst-case default.

Environmental Metrics (14 Optional)

• Security Requirements (CR, IR, AR): X (Not Defined, treated as H), H (High), M (Medium), L (Low).
• Modified Base Metrics: MAV, MAC, MAT, MPR, MUI, MVC, MVI, MVA, MSC, MSI, MSA.
• Safety Impact Values on Subsequent Systems: MSI (Modified Subsequent System Integrity) and MSA (Modified Subsequent System Availability) include an additional S (Safety) option above H when exploitation can cause physical human safety harm.

Supplemental Metrics (6 Optional)

Supplemental metrics are purely informational and never alter the numeric CVSS v4.0 score:

• Safety (S): X (Not Defined), N (Negligible), P (Present)
• Automatable (AU): X (Not Defined), N (No), Y (Yes)
• Recovery (R): X (Not Defined), A (Automatic), U (User), I (Irrecoverable)
• Value Density (V): X (Not Defined), D (Diffuse), C (Concentrated)
• Vulnerability Response Effort (RE): X (Not Defined), L (Low), M (Medium), H (High)
• Provider Urgency (U): X (Not Defined), Clear, Green, Amber, Red

How CVSS v4.0 MacroVector Scoring Works

Unlike v3.x algebraic formulas, CVSS v4.0 maps the effective metrics (where Modified Environmental metrics override Base metrics when defined) into a 6-digit MacroVector (eq1 through eq6):

1. eq1 (0-2): Exploitability prerequisites (AV, PR, UI).
2. eq2 (0-1): Complexity and requirements (AC, AT).
3. eq3 (0-2): Vulnerable system impact (VC, VI, VA).
4. eq4 (0-2): Subsequent system impact (SC, SI, SA, including MSI:S and MSA:S).
5. eq5 (0-2): Threat Exploit Maturity (E: A=0, P=1, U=2).
6. eq6 (0-1): Combined Vulnerable Impact and Security Requirements (VC/VI/VA with CR/IR/AR).

If all six effective impact metrics (VC, VI, VA, SC, SI, SA) are N, the score is 0.0 (None). Otherwise, the engine looks up the baseline score of the active MacroVector in the official FIRST 270-entry lookup table, computes the severity distance from the highest-severity vectors in the same MacroVector, and interpolates against the next lower MacroVector across eq1..eq6, rounding to one decimal place.