VEX
Vulnerability Exploitability eXchange
A machine-readable statement of whether a product is affected by a vulnerability (not affected, affected, fixed or under investigation), with a justification. Formats include CSAF, OpenVEX and CycloneDX; the issuer, evidence and freshness still matter.
- Defined in
- CISA minimum requirements for VEX
Covered in
Guide
Use VEX without losing vulnerability evidence
Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.
Guide
Publish security advisories with CSAF, VEX, CVE records and OSV
What a useful security advisory contains and how to publish it in the formats tools read: a validated CSAF 2.0 VEX document, the CSAF provider files, CVE records through a CNA (CVE Record Format 5.2), and OSV records for open-source packages. Covers the status of CSAF 2.1 as of October 2026.