What Is VEX (Vulnerability Exploitability eXchange)?

VEX (Vulnerability Exploitability eXchange) is a machine-readable statement from a software supplier saying whether a specific product is affected by a specific vulnerability. Its purpose is to stop users chasing CVEs that a scanner reports in a component but that cannot actually be exploited in that product.

How VEX works

VEX grew out of the U.S. NTIA's software-transparency work on SBOMs, and CISA now documents it. CISA's minimum requirements define four status values:

• Not affected: no remediation is needed. This status must carry a justification or an impact statement.
• Affected: action is recommended, and the statement should say what to do.
• Fixed: the listed product versions contain a fix.
• Under investigation: the supplier does not know yet.

Accepted justifications for "not affected" include: the component is not present, the vulnerable code is not present, the vulnerable code is not in the execution path, the vulnerable code cannot be controlled by an adversary, and inline mitigations already exist.

VEX is a data model rather than a single file format. It is commonly expressed as a CSAF 2.0 document using the VEX profile, as an OpenVEX document, or inside a CycloneDX BOM. A VEX statement usually travels with an SBOM. The SBOM says what is in the product, and the VEX says which reported vulnerabilities matter.

How GeekWala relates to VEX

GeekWala does not write VEX documents. It gives you the evidence to gather before you write one: the affected package and version, the fixed version where one exists, and EPSS and CISA KEV signals that show whether a CVE is being exploited. A "not affected" statement should rest on exactly that kind of evidence, not on a hunch that a scanner finding "probably doesn't matter."

Sources: CISA — Minimum Requirements for Vulnerability Exploitability eXchange (VEX) · OpenVEX specification

Related terms

• SBOM (Software Bill of Materials)
• Reachability Analysis
• CISA KEV (Known Exploited Vulnerabilities)
• EPSS (Exploit Prediction Scoring System)

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 14, 2026