VEX

What it means

VEX stands for Vulnerability Exploitability eXchange. It is a machine-readable statement from a software supplier that says, for a specific product and a specific known vulnerability, whether the product is affected.

CISA describes four statuses: not affected, affected, fixed and under investigation. A not-affected statement carries a reason, such as the vulnerable code not being present or not being reachable. Formats include CSAF, OpenVEX and CycloneDX.

Why it matters

Scanning an SBOM against vulnerability databases produces long lists. Many entries concern a library included in the product but whose vulnerable function is never called. Customers see an alarming list and send you questions.

VEX lets the supplier answer once, in a form tools can read. Customers can filter out what does not apply and focus on what does. It saves time on both sides, as long as the claims are honest.

How it shows up

You meet VEX documents next to SBOMs when a supplier ships software to a regulated or large buyer. The supplier's team analyses each reported flaw, decides the status, and publishes the statement, updating it as things change.

Mistakes include marking things not affected without checking, never updating after new findings, and treating VEX as a way to dismiss real problems. Use exploitability evidence: a flaw that was tested and could not be reached is a stronger claim than a guess.