Glossary
VEX (Vulnerability Exploitability eXchange)
A machine-readable statement from a supplier about whether a product is actually affected by a specific vulnerability.
Vulnerability Exploitability eXchange (VEX) is a form of security advisory that states whether a product is affected by a given vulnerability. Each statement carries a status — Not Affected, Affected, Fixed or Under Investigation — and a Not Affected status is expected to include a justification, such as the vulnerable code not being present or not being reachable.
VEX exists because software composition scanning finds components, not exploitability. A product may contain a library with a known CVE while never calling the vulnerable function. VEX can be expressed in several formats, including CSAF VEX, CycloneDX and OpenVEX.
For a VOC, supplier VEX statements are evidence for suppressing false alarms without hiding real risk, and they belong in the justification of any "not affected" decision. See exceptions and risk acceptance.