Security · Flashcard
Which set of statuses does a VEX statement use?
- ANot affected, affected, fixed, and under investigation
- BOpen, in progress, resolved, and closed without action
- CCritical, high, medium, and low by technical severity
- DReachable, unreachable, unknown, and not applicable
Why this is the answer
Those four cover the supplier's possible positions on a CVE, including the honest interim of under investigation. Ticket lifecycle states describe internal workflow rather than product impact, severity bands are CVSS, and while reachability often justifies a not-affected claim it is evidence for a status rather than a status itself.
Official docs