What is VEX? Vulnerability Exploitability eXchange, defined for patch teams

Vulnerability Exploitability eXchange (VEX) is a machine-readable security advisory in which a software supplier, or another party, states whether a specific product is affected by a specific known vulnerability. Patch teams use VEX to set aside scanner findings that do not apply to a product they run and to act on the ones that do.

The four statuses

CISA's April 2022 use-case paper sets four product statuses. Not affected means no remediation is required. Affected means action is recommended. Fixed means the listed versions contain a fix. Under investigation means the supplier does not yet know. An affected status must carry an action statement, and a not affected status must carry an impact statement explaining why.

Each document also carries metadata (format, document identifier, author, author role and timestamp), product identifiers, and the vulnerability's CVE or other ID. CISA's Minimum Requirements for VEX, published on 21 April 2023, specifies these minimum elements.

What VEX is not

VEX is not an exploitation signal. CISA's November 2023 guidance, When to Issue VEX Information, says VEX does not describe threat or how far a vulnerability is being exploited, and points to the KEV catalog for exploited flaws. Nor is VEX a software bill of materials: CISA's SBOM page calls a VEX document an attestation about whether a product is affected, while the SBOM lists what the product contains.

What a patch desk does with it

When a scanner flags a library CVE inside a vendor product, look for the supplier's VEX statement before opening a ticket. A not affected status with its impact statement can close the finding, and the document becomes the audit record. An under investigation status means ask again: CISA expects issuers to update the status once the investigation concludes.

Two cautions from the same guidance. Do not assume an upstream component's status carries into the product built on it, and decide how far to trust each author, since VEX conveys the author's assertions. CISA recommends digitally signing VEX information.

Where it appears on Daily CISO

Must-patch lists the confirmed-exploited CVEs where a supplier's VEX status matters most, and the KEV guide explains the exploitation evidence CISA requires, which a VEX statement does not provide. The security glossary covers supply chain risk management, the discipline VEX and SBOMs serve.

Related terms

Software bill of materials (SBOM), Common Vulnerabilities and Exposures (CVE), Known Exploited Vulnerabilities (KEV) catalog and Common Platform Enumeration (CPE).