# Vulnerability Exploitability eXchange **Acronym:** VEX **Entity class:** Machine-readable vulnerability status document ## Definition **Vulnerability Exploitability eXchange (VEX)** communicates whether and why a product or component is affected by a known vulnerability. It complements an [[wiki/Software Bill of Materials|SBOM]]: the SBOM says what is present; VEX expresses the supplier's assessment of whether a vulnerability is exploitable in that product context and may carry remediation information. ## Neurosecurity relevance A human-machine system requires comparable state distinctions across device, model, configuration, command path, and biological effect. A vulnerability can exist in a dependency without being reachable in one configuration, while a change in permissions, connectivity, or stimulation authority can make it reachable later. ## Relationships - **component inventory:** [[wiki/Software Bill of Materials|Software Bill of Materials]]. - **record identity:** [[wiki/Common Vulnerabilities and Exposures|CVE]]. - **architecture:** [[wiki/Continuous Vulnerability Intelligence|Continuous Vulnerability Intelligence]]. - **state estimation:** [[wiki/Human-Machine State Estimation|Human-Machine State Estimation]]. ## Sources / Provenance - Cybersecurity and Infrastructure Security Agency, [“Minimum Requirements for Vulnerability Exploitability eXchange”](https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex), 2022. **As of:** 2026-09-23