Skip to content
Vol. 1 · Ed. 2026
CyberGlossary
Français
Entry № 1328

VEX (Vulnerability Exploitability eXchange)

Qu'est-ce que VEX (Vulnerability Exploitability eXchange) ?

VEX (Vulnerability Exploitability eXchange)A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'.

VEX (Vulnerability Exploitability eXchange) is a class of attestation document, formalized by CISA and the U.S. NTIA in 2022–2023, designed to suppress SBOM noise. When a customer scans a vendor's product, they typically discover every CVE listed against every transitive dependency — most of which are not actually exploitable because the affected code path is unused, mitigated, or compiled out. A VEX statement, signed by the vendor or downstream maintainer, declares one of four statuses for each (product, CVE) pair: not_affected, affected, fixed, or under_investigation, plus a justification (e.g. 'vulnerable_code_not_in_execute_path'). VEX is format-agnostic and is currently produced as OpenVEX (a minimal JSON profile), CSAF VEX (an OASIS-standardized profile), or embedded in CycloneDX vulnerability extensions. It is becoming a contractual deliverable alongside SBOMs in regulated sectors.

● Exemples

  1. 01

    A library upgrade adds a transitive dep flagged with five CVEs; the vendor ships an OpenVEX document marking four as 'not_affected: vulnerable_code_not_in_execute_path'.

  2. 02

    An automated scanner consumes the customer's SBOM plus the vendor's VEX statements and reduces 200 raw CVE findings to 7 actionable ones.

● Questions fréquentes

Qu'est-ce que VEX (Vulnerability Exploitability eXchange) ?

A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'. Cette notion relève de la catégorie Sécurité applicative en cybersécurité.

Que signifie VEX (Vulnerability Exploitability eXchange) ?

A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'.

Comment fonctionne VEX (Vulnerability Exploitability eXchange) ?

VEX (Vulnerability Exploitability eXchange) is a class of attestation document, formalized by CISA and the U.S. NTIA in 2022–2023, designed to suppress SBOM noise. When a customer scans a vendor's product, they typically discover every CVE listed against every transitive dependency — most of which are not actually exploitable because the affected code path is unused, mitigated, or compiled out. A VEX statement, signed by the vendor or downstream maintainer, declares one of four statuses for each (product, CVE) pair: not_affected, affected, fixed, or under_investigation, plus a justification (e.g. 'vulnerable_code_not_in_execute_path'). VEX is format-agnostic and is currently produced as OpenVEX (a minimal JSON profile), CSAF VEX (an OASIS-standardized profile), or embedded in CycloneDX vulnerability extensions. It is becoming a contractual deliverable alongside SBOMs in regulated sectors.

Comment se défendre contre VEX (Vulnerability Exploitability eXchange) ?

Les défenses contre VEX (Vulnerability Exploitability eXchange) combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.

Quels sont les autres noms de VEX (Vulnerability Exploitability eXchange) ?

Noms alternatifs courants : Vulnerability Exploitability eXchange, OpenVEX, CSAF VEX.

● Termes liés