Security+ 801 Countdown, T-33: CVSS, CVE, and Threat Intelligence Move Into New Objective 2.1

Every vulnerability scanner report, vendor advisory, and government alert speaks the same compact language: a CWE number for the kind of mistake, a CVE number for the specific flaw, a CVSS score for how severe it would be, and a KEV flag or an EPSS probability for whether anyone is exploiting it. Each token answers a different question, and a reader who treats them as interchangeable will patch the wrong things first. Threat and vulnerability characteristics are the vocabulary that keeps those questions apart, and the vocabulary exists because the volume of disclosed flaws outran any team’s ability to fix everything at once years ago. SY0-801 objective 2.1, “Explain characteristics of threats and vulnerabilities,” is new in SY0-801 and gathers vulnerability scoring, CVE identifiers, threat feeds, intelligence sources, likelihood, impact, prioritization, and the intelligence life cycle under one heading (CompTIA 2025).

The exam tests concepts and workflow separately. Objective 2.1 asks what a score, an identifier, and a feed mean; objective 4.3 (“Given a scenario, perform tasks associated with vulnerability management”) asks you to act on them (T-13). One idea ties the two together: a CVSS score describes how bad a flaw is anywhere, and priority describes how likely and costly it is here. Treat a CVSS number as a patch order and you lose points in both.

One flaw, five identifiers

A single software defect collects several names on its way from a developer’s mistake to a line in your patch queue. The chain runs CWE (weakness class) to CVE (one instance) to CVSS (severity) to KEV and EPSS (exploitation evidence and forecast) to asset context (priority), which only you supply. The first links are assigned by other people and published in databases; the last one cannot be, because nobody outside your organization knows what the affected host does.

The Common Weakness Enumeration (CWE) is the taxonomy for code flaws, independent of any product. A CWE entry names the type of mistake: the 2025 CWE Top 25 ranks CWE-79 (cross-site scripting) first and CWE-78 (OS command injection) ninth (MITRE 2025). Many unrelated products share the same CWE, so a CWE number can never identify a specific flaw.

Common Vulnerabilities and Exposures (CVE) names one publicly disclosed vulnerability. A CVE Numbering Authority (CNA) assigns the ID and publishes the record, which starts Reserved and becomes Published or Rejected (CVE Program 2026). The identifier’s format carries less information than people assume: the number after the CVE year runs 4 to 19 digits, and the year marks discovery or publication, not exploitation (CVE Program n.d.). CVE-2026-102490 has six digits; CVE-2015-3306 (ProFTPD) entered KEV on October 8, 2026, so an old year prefix is no evidence that attackers have lost interest.

The National Vulnerability Database (NVD) is NIST’s database. It mirrors the CVE List and adds CVSS scores, CWE mappings, and CPE product strings, which name the affected product so that a scanner can match a record against an inventory. Volume forces prioritization: over 67,000 CVEs were published in 2026 as of September 18 (CISA 2026c), and no team patches at that rate.

Reading a record from NVD

The enrichment NVD adds is no longer uniform. Since April 15, 2026, NIST enriches KEV entries first (“within one business day of receipt”), then federal-use and EO 14028 critical software, and no longer routinely adds its own score when the CNA already scored the CVE (NIST 2026). The number you see in NVD is therefore often the CNA’s, labeled Secondary. One real record, queried October 12, 2026 (output condensed):

$ curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-0111" | jq '.vulnerabilities[0].cve | {id, vulnStatus, cvss31: [.metrics.cvssMetricV31[] | {source, score: .cvssData.baseScore, vector: .cvssData.vectorString}], cvss40: [.metrics.cvssMetricV40[] | {source, score: .cvssData.baseScore}], cwe: [.weaknesses[].description[].value] | unique, cisaExploitAdd, cisaActionDue}'
{
  "id": "CVE-2025-0111",
  "vulnStatus": "Analyzed",
  "cvss31": [{"source": "nvd@nist.gov", "score": 6.5, "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],
  "cvss40": [{"source": "psirt@paloaltonetworks.com", "score": 7.1}],
  "cwe": ["CWE-610", "CWE-73"],
  "cisaExploitAdd": "2025-02-20",
  "cisaActionDue": "2025-03-13"
}

CVE-2025-0111 is an authenticated file read through the PAN-OS management interface. Most of the chain is visible in this one record: the CWE mappings (CWE-610 and CWE-73) classify the weakness, the CVE ID names the instance, two CVSS scores measure severity, and cisaExploitAdd is its KEV date. NIST scored it 6.5 in CVSS v3.1; Palo Alto, the CNA, scored it 7.1 in v4.0 when that interface faces the internet and 5.9 when only a jump box reaches it. Two scores for one flaw is not a disagreement; it is the first hint that severity depends on assumptions, which is the subject of the next section.

CVSS v4.0 measures severity, not risk

The Common Vulnerability Scoring System (CVSS) expresses the severity of a vulnerability as a vector of metric values and a number from 0.0 to 10.0 computed from them. FIRST published CVSS v4.0 on November 1, 2023 (FIRST 2024). Its four metric groups are Base (intrinsic traits of the flaw), Threat (Exploit Maturity), Environmental (your CR, IR, and AR requirements, meaning the confidentiality, integrity, and availability requirements of the affected asset, plus Modified Base metrics), and Supplemental (Safety, Automatable, and others that never change the number). The bands are None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, and Critical 9.0 to 10.0. Because the groups can be applied in combinations, every number should carry a label saying which groups produced it: CVSS-B, CVSS-BT, CVSS-BE, or CVSS-BTE (FIRST 2025).

A vector string is the score’s audit trail. The same flaw in v4.0 and v3.1 notation:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N    9.3 Critical (CVSS-B)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                       9.8 Critical

The v4 vector reads: network attack vector, low complexity, no attack requirements (AT, new in v4), no privileges or user interaction, high impact on the vulnerable system (VC, VI, VA), and none on subsequent systems (SC, SI, SA). The same traits score 9.8 in v3.1, which had Scope and a different formula; never compare numbers across versions.

What the consumer adds

The Base group belongs to whoever publishes the advisory. Applying Threat and Environmental metrics “is the responsibility of the CVSS consumer” (FIRST 2025), which means the score on an advisory is the beginning of your assessment, not the end of it. The vector above in FIRST’s v4.0 calculator, with consumer metrics added:

Added metrics	Score	Label
None	9.3 Critical	CVSS-B
E:A (exploitation reported)	9.3 Critical	CVSS-BT
E:P (public proof of concept)	8.9 High	CVSS-BT
E:U (no known exploit)	8.1 High	CVSS-BT
E:U/CR:L/IR:L/AR:L (low-value asset)	6.5 Medium	CVSS-BTE
E:U/MAV:L (local access only here)	6.1 Medium	CVSS-BTE

Two rules explain the table. Undefined Exploit Maturity is scored as Attacked, so a base score assumes the worst case and Threat metrics can only hold or lower it. Environmental metrics then adjust for what the asset is worth and how it is reached: low requirements on a low-value asset, or a Modified Attack Vector of Local because the service is not network-reachable here, pull the 9.3 down into Medium. FIRST’s own caveat: CVSS-B scores “should not be used alone to assess risk” (FIRST 2025).

Prioritization: why a 6.5 can outrank a 9.8

Severity describes the flaw. Risk adds two things the score cannot see: the likelihood that this flaw will be exploited and the impact if it is, on this asset. Two public data sources supply likelihood evidence, and both are now exam vocabulary.

CISA’s Known Exploited Vulnerabilities (KEV) catalog is evidence of the past: an entry needs a CVE ID, reliable evidence of active exploitation, and clear remediation guidance, and a public proof of concept alone does not qualify (CISA 2026e). On October 12, 2026, KEV held 1,739 entries, and more than 140 of them carried a Medium or Low CVSS v3 rating in NVD. EPSS is a forecast of the future: it “estimates the probability a vulnerability will be exploited in the wild within the next 30 days”; version 5 (model v2026.06.15) has scored daily since June 15, 2026 (FIRST 2026a; FIRST 2026b).

CISA’s Binding Operational Directive (BOD) 26-04, issued June 10, 2026, revoked BOD 22-01 and its two-week default. Its inputs are In KEV, Publicly Exposed, Automatable, and Technical Impact; outcomes run from 3 days plus forensic triage down to fix on system upgrade (CISA 2026b). Of KEV entries added since June 10, 2026, 99 carry 3-day due dates and 23 carry 14-day ones. Neither CVSS nor EPSS is an input. It binds only federal civilian agencies; everyone else should use KEV “as an input to their vulnerability management prioritization framework” (CISA 2026d).

A worked triage

When I teach this in ITN 260, the habit to break is sorting the scanner export by CVSS and patching from the top. Five hypothetical findings (CVSS v3.1 scores from FIRST’s calculator, invented EPSS values):

Finding	CVSS v3.1	KEV; EPSS	Context
A: lab-db01	9.8	No; 0.003	Isolated lab VLAN, test data
B: vpn.example.com	6.5	Yes; 0.02	Internet-facing VPN for all remote staff
C: 600 laptops	8.8	No; 0.40	Web browser; user must visit a malicious page
D: www.example.com	7.5	No; 0.02	Public web server with customer PII
E: fs01	7.8	Yes, ransomware use Known; 0.15	Internal file server

Three ways to order the same five findings:

• CVSS only: A, C, E, D, B.
• KEV first, then CVSS: E, B, A, C, D.
• Risk-based (KEV, then internet exposure, then EPSS, then asset value; CVSS breaks ties): B, E, D, C, A.

Under BOD 26-04, assuming only A and D are automatable and only A, C, and E have total technical impact, B, D, and E get 14 days, A gets 60, and C waits for a system upgrade. The 6.5 tops the risk-based order and shares BOD 26-04’s shortest deadline here (14 days, with D and E); the 9.8 drops to last in the risk-based order and gets 60 days under BOD 26-04, behind three lower-scored findings. C shows the limit of any single model: a strong EPSS signal that BOD 26-04 ignores. Real cases fit the pattern: CVE-2025-0111 and SonicWall’s CVE-2021-20035 are CVSS v3.1 6.5 management-interface flaws in KEV, and CVE-2025-0111’s EPSS on October 12, 2026 was only 0.01999.

Basically, the score says how bad a flaw is anywhere; priority says how likely and costly it is here.

Threats: sources, feeds, and intelligence

The threat half of the objective uses three words that practitioners often blur, and NIST SP 800-150 separates them. Sources are origins: sharing communities, government repositories, internal telemetry, commercial feeds, and open sources (Johnson et al. 2016). A feed is machine-readable delivery; the KEV JSON file, the daily EPSS CSV, and CISA’s free Automated Indicator Sharing (AIS) service over TAXII 2.1 are feeds (CISA 2026a). Threat intelligence is information “aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making.” A feed can carry raw indicators with no analysis attached; it becomes intelligence only when someone adds the context that supports a decision. Two sharing bodies appear by acronym: an ISAC serves a critical-infrastructure sector; an ISAO, any community of interest. STIX belongs to T-25.

Likelihood and impact

Likelihood and impact are the two factors of risk, and they appear here and again in objective 5.2, home of the SLE and ALE math (T-6). For a vulnerability, likelihood draws on KEV, EPSS, Exploit Maturity, the exploitability metrics (AV, AC, AT, PR, UI), and exposure; impact draws on the six impact metrics, CR, IR, and AR, and the business function at stake. Every input in the triage above slots into one of those two columns, which is why a risk-based ordering can be defended line by line.

The intelligence life cycle

“Life cycle” has no CompTIA definition. My interpretation is the intelligence cycle, which the U.S. Intelligence Community gives as six steps (INTEL.gov n.d.). An illustrative trace of one requirement through the cycle:

1. Planning: alert us within one business day when a KEV entry touches our edge devices.
2. Collection: pull the KEV JSON and vendor PSIRT advisories.
3. Processing: match cveID and product against the asset inventory and CPE strings.
4. Analysis: two firewalls expose the affected management interface to the internet.
5. Dissemination: open a change ticket and push a SIEM watchlist entry.
6. Evaluation: judge whether the alert was timely and actionable, then adjust the requirement.

The last step is the one teams skip: a feed that is never evaluated keeps producing alerts nobody acts on. Other readings of “life cycle” are the CVE Record lifecycle (Reserved, Published, Rejected) or a vulnerability’s discovery-to-patch life cycle. “Vulnerability types” is also undefined; it most likely points to the 801 2.4 categories (T-29), and CWE is the taxonomy for code flaws.

What you need to know for SY0-801

• CVE means Common Vulnerabilities and Exposures. The SY0-701 objectives printed it as “Common Vulnerability Enumeration,” which echoes CWE (Common Weakness Enumeration), a likely distractor.
• One flaw’s unique ID is CVE; its severity is CVSS; its weakness category is CWE; NIST’s enriched database is NVD; the affected product name is CPE.
• CVSS v4.0 bands: None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0. Never compare a v4.0 number with a v3.1 number.
• CVSS v4.0: Base comes from the provider, Threat and Environmental from the consumer, and Supplemental never changes the score. Label the result CVSS-B, CVSS-BT, CVSS-BE, or CVSS-BTE.
• Severity is not risk; risk adds likelihood (KEV, EPSS, exposure) and impact (asset criticality).
• KEV is confirmed past exploitation and wins over EPSS, a 30-day forecast whose percentile is a rank: 0.80 is not an 80 percent chance.
• A source originates, a feed delivers, and intelligence is analyzed for a decision.
• Objective 2.1 tests prioritization as a concept; objective 4.3 tests the workflow, where it heads severity assessment and pen test report review (T-13).

Check yourself

These are original practice questions, not exam items.

1. A remote-access appliance advisory lists CWE-78, CVE-2021-20035, a CVSS v3.1 base score of 6.5, and a CISA KEV entry. Which statement is accurate?

• A. CWE-78 uniquely identifies this appliance flaw.
• B. CVE-2021-20035 identifies one disclosed vulnerability, and CWE-78 names its weakness type.
• C. A Medium score means the fix can wait for the next cycle.
• D. The KEV entry is a 30-day exploitation probability.

Answer: B. CVE identifies the instance; CWE classifies the weakness. KEV records confirmed exploitation, not a probability (EPSS), so this Medium score is still urgent.

2. A team can deploy one fix tonight. Which finding should it remediate first?

• A. CVSS v3.1 9.8 on an isolated test server, not in KEV.
• B. CVSS v3.1 6.5 on an internet-facing VPN gateway, listed in KEV.
• C. CVSS v3.1 8.8 in a desktop app that requires a user to open a file.
• D. CVSS v3.1 7.5 on an internal print server with public proof-of-concept code.

Answer: B. Confirmed exploitation on an internet-exposed asset outweighs higher severity elsewhere. A public proof of concept alone does not meet KEV’s evidence bar.

3. An analyst takes a vendor’s CVSS v4.0 vector, adds E:U, and sets CR, IR, and AR to Low because the host holds test data. How should the resulting 6.5 be labeled?

• A. CVSS-B.
• B. CVSS-BT.
• C. CVSS-BE.
• D. CVSS-BTE.

Answer: D. Exploit Maturity is a Threat metric and the requirements are Environmental metrics, so both groups apply; the vendor’s unmodified score was CVSS-B.

This is T-33 of the Security+ 801 Countdown: one change from SY0-701 to SY0-801 every morning until the new exam launches on November 17, 2026. Tomorrow, T-32: Threat Actors Rewritten With Terrorists, Competitors, and Accidents. New here? Start with T-38: The Blueprint Was Reweighted and Trimmed to 27 Objectives.

References

CISA (Cybersecurity and Infrastructure Security Agency). 2026a. “Automated Indicator Sharing (AIS).” Accessed October 12, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026b. “BOD 26-04: Prioritizing Security Updates Based on Risk.” June 10, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026c. CVE Program: Establishing a Quality Era Framework. September 22, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026d. “Known Exploited Vulnerabilities Catalog.” Accessed October 12, 2026.

CISA (Cybersecurity and Infrastructure Security Agency). 2026e. “Reducing the Significant Risk of Known Exploited Vulnerabilities.” Accessed October 12, 2026.

CompTIA. 2023. CompTIA Security+ SY0-701 Certification Exam Objectives. Version 5.0.

CompTIA. 2025. CompTIA Security+ SY0-801 V8 Certification Exam Objectives. Document Version 2.0.

CVE Program. 2026. “Glossary.” CVE. Accessed October 12, 2026.

CVE Program. n.d. “CVE Record Format.” JSON schema. Accessed October 12, 2026.

FIRST (Forum of Incident Response and Security Teams). 2024. Common Vulnerability Scoring System Version 4.0: Specification Document. Document version 1.2. See also the v4.0 calculator and v3.1 calculator.

FIRST (Forum of Incident Response and Security Teams). 2025. Common Vulnerability Scoring System Version 4.0: User Guide. Document version 1.2.

FIRST (Forum of Incident Response and Security Teams). 2026a. “EPSS Frequently Asked Questions.” Accessed October 12, 2026.

FIRST (Forum of Incident Response and Security Teams). 2026b. “Get the Data.” EPSS. Accessed October 12, 2026.

INTEL.gov. n.d. “How the IC Works.” Accessed October 12, 2026.

Johnson, Chris, Lee Badger, David Waltermire, Julie Snyder, and Clem Skorupka. 2016. Guide to Cyber Threat Information Sharing. NIST Special Publication 800-150.

MITRE. 2025. “2025 CWE Top 25 Most Dangerous Software Weaknesses.” Common Weakness Enumeration.

NIST (National Institute of Standards and Technology). 2026. “NIST Updates NVD Operations to Address Record CVE Growth.” April 15, 2026.