--- title: "VEX, Vulnerability Exploitability eXchange | MedTech Terms" description: "A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/vex#term", "name": "Vulnerability Exploitability eXchange", "alternateName": "VEX", "description": "Vulnerability Exploitability eXchange (VEX) is a machine-readable security advisory format that lets a software producer state, for each CVE that appears in their product's SBOM, whether the vulnerability is exploitable in their product (\"affected\"), not exploitable (\"not_affected\" with a justification), already fixed, or under investigation. VEX is typically expressed in CycloneDX VEX, CSAF (Common Security Advisory Framework), or OpenVEX formats. CISA publishes the canonical use cases.", "url": "https://medtechterms.com/terms/vex", "termCode": "vex", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/vex#article", "headline": "VEX, Vulnerability Exploitability eXchange", "description": "A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.", "url": "https://medtechterms.com/terms/vex", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/vex" }, "about": { "@id": "https://medtechterms.com/terms/vex#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Vulnerability Exploitability eXchange, VEX, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "CISA VEX Use Cases", "url": "https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf", "publisher": { "@type": "Organization", "name": "CISA" } }, { "@type": "CreativeWork", "name": "OASIS CSAF 2.0", "url": "https://oasis-open.github.io/csaf-documentation/", "publisher": { "@type": "Organization", "name": "OASIS" } }, { "@type": "CreativeWork", "name": "OpenVEX Specification", "url": "https://github.com/openvex/spec", "publisher": { "@type": "Organization", "name": "OpenVEX" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cve#term", "name": "Common Vulnerabilities and Exposures", "alternateName": "CVE", "url": "https://medtechterms.com/terms/cve" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cvss#term", "name": "Common Vulnerability Scoring System", "alternateName": "CVSS", "url": "https://medtechterms.com/terms/cvss" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/cyclonedx#term", "name": "CycloneDX", "url": "https://medtechterms.com/terms/cyclonedx" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Vulnerability Exploitability eXchange", "item": "https://medtechterms.com/terms/vex" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/vex#faq", "mainEntity": [ { "@type": "Question", "name": "What are valid VEX justifications?", "acceptedAnswer": { "@type": "Answer", "text": "CISA defines five: component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary, and inline_mitigations_already_exist. Every 'not_affected' status should cite one." } }, { "@type": "Question", "name": "Where should we publish VEX?", "acceptedAnswer": { "@type": "Answer", "text": "Most MedTech teams publish via a vendor security advisory portal (often paired with PSIRT) and also embed VEX inside the CycloneDX SBOM file. CSAF is becoming the preferred wire format for distribution." } }, { "@type": "Question", "name": "Is VEX required by FDA?", "acceptedAnswer": { "@type": "Answer", "text": "Not explicitly required, but FDA's 2023 guidance expects a process to 'monitor, identify, and address' vulnerabilities - VEX is the most efficient way to do that at scale and is the de facto industry expectation." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Vulnerability Exploitability eXchange [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)VEX # Vulnerability Exploitability eXchange A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition Vulnerability Exploitability eXchange (VEX) is a machine-readable security advisory format that lets a software producer state, for each [CVE](/terms/cve) that appears in their product's [SBOM](/terms/sbom), whether the vulnerability is exploitable in their product ("affected"), not exploitable ("not\_affected" with a justification), already fixed, or under investigation. VEX is typically expressed in [CycloneDX](/terms/cyclonedx) VEX, CSAF (Common Security Advisory Framework), or OpenVEX formats. CISA publishes the canonical use cases. What the regulation says FDA's 2023 guidance encourages but does not yet mandate VEX. CISA strongly recommends pairing every [SBOM](/terms/sbom) with a VEX feed so operators can triage CVEs that affect components but not the integrated product. EU NIS2 and the upcoming Cyber Resilience Act in Europe move toward expecting VEX-style exploitability disclosures. ## What this means in practice Without VEX, every [CVE](/terms/cve) that touches any [SBOM](/terms/sbom) component becomes a triage burden for hospitals. With VEX, vendors push the exploitability decision once and operators can filter their device fleet to the truly affected subset. Mature MedTech teams generate VEX as part of the same CI/CD flow that emits the SBOM. Common pitfalls - • Marking components 'not\_affected' without a documented justification - the justification field is the whole value of VEX. - • Publishing VEX once at release and never updating as new CVEs are disclosed against existing components. - • Using inconsistent identifiers (CPE vs PURL vs SWID) that prevent automated matching against the SBOM. ## Frequently asked questions What are valid VEX justifications? CISA defines five: component\_not\_present, vulnerable\_code\_not\_present, vulnerable\_code\_not\_in\_execute\_path, vulnerable\_code\_cannot\_be\_controlled\_by\_adversary, and inline\_mitigations\_already\_exist. Every 'not\_affected' status should cite one. Where should we publish VEX? Is VEX required by FDA? ## Cross-references ### See also Closely related context worth reading. - [ Software Bill of Materials(SBOM) ](/terms/sbom) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve)[ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity?from=fda-cybersecurity-101)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b?from=fda-cybersecurity-101)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf?from=fda-cybersecurity-101)[ Cybersecurity STRIDE Threat Model(STRIDE) A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. ](/terms/stride?from=fda-cybersecurity-101) Cited by Where this term appears across MedTech Terms. Learning paths (1) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 8 of 11 Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 CISA· 1 OASIS· 1 OpenVEX· 1 1. [1 CISA VEX Use Cases Verified CISA · cisa.gov ](https://www.cisa.gov/sites/default/files/2023-04/minimum-requirements-for-vex-508c.pdf) 2. [2 OASIS CSAF 2.0 Verified OASIS · oasis-open.github.io ](https://oasis-open.github.io/csaf-documentation/) 3. [3 OpenVEX Specification Verified OpenVEX · github.com ](https://github.com/openvex/spec) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym VEX Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=vex) Learn in 60 seconds Card Lesson Quiz A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. - · Without VEX, every CVE that touches any SBOM component becomes a triage burden for hospitals. - · With VEX, vendors push the exploitability decision once and operators can filter their device fleet to the truly affected subset. - · Mature MedTech teams generate VEX as part of the same CI/CD flow that emits the SBOM. Remember this Watch out: Marking components 'not\_affected' without a documented justification - the justification field is the whole value of VEX. Related terms - [Software Bill of Materials(SBOM) ](/terms/sbom) - [Common Vulnerabilities and Exposures(CVE) ](/terms/cve) - [Common Vulnerability Scoring System(CVSS) ](/terms/cvss) - [CycloneDX ](/terms/cyclonedx) You may also need Auto-suggested from Cybersecurity and shared keywords. - [CISA Known Exploited Vulnerabilities Catalog(KEV) ](/terms/kev) - [SPDX(SPDX) ](/terms/spdx) - [HITRUST CSF(HITRUST) ](/terms/hitrust) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) - [Common Weakness Enumeration(CWE) ](/terms/cwe) - [Coordinated Vulnerability Disclosure(CVD) ](/terms/cvd) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)