CVSS v4.0 Calculator

Where the attacker must be to exploit the flaw — over the internet (Network), on the same local network (Adjacent), with local access (Local), or physically touching the device (Physical).

How much an attacker has to defeat security measures that aren't under their control. Low means the attack works reliably; High means they must beat extra protections first.

Whether the attack needs special conditions that the attacker doesn't control to be in place first, such as a race condition or a particular configuration.

What level of account or access the attacker needs before attacking — none at all, a normal user account (Low), or an administrator account (High).

Whether a victim has to do something for the attack to work — nothing (None), a routine action (Passive), or being tricked into a deliberate action like clicking a link (Active).