thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Vulnerability Exploitability eXchange (VEX)

A machine-readable advisory stating whether a product is actually affected by a known vulnerability in one of its components.

Definition

VEX statuses include Not Affected, Affected, Fixed and Under Investigation, with justifications such as vulnerable code not present or not reachable. VEX reduces false alarms when SBOM matching flags vulnerable components that are not exploitable in the product.

Example

A vendor VEX stating its product is "Not Affected" by a library CVE because the vulnerable function is never called.

Exam tip

VEX complements SBOM to reduce false positives in component vulnerability matching.

Related terms