Reply fast with a status, even if it is "under investigation". Name the product versions covered, say what you have checked, state interim steps and promise a time for the next update. Move to "not affected" or "affected" only when you have evidence, and use the same words in every reply.
Why speed and honesty both matter
A customer who asks this is trying to decide whether to act. A reply that arrives within a working day with a clear status is more useful than a perfect one a week later. But an early "not affected" that later reverses costs trust far more than an early "under investigation".
CISA's minimum elements for VEX list under investigation as a legitimate status, alongside not affected, affected and fixed. Using it is not an admission of weakness. It is the accurate state.
The template
Keep it to a short email.
Subject: Status of CVE number for product name
Status: one of: under investigation, not affected, affected, fixed.
Scope: The product versions this answer covers.
What we checked: The component list for those versions and, if relevant, whether a call path to the vulnerable code exists, with the date.
What you should do now: Interim steps, or "no action needed on your side" only if status is not affected and you have evidence.
Next update: A specific time, or "when status changes".
Contact: A named person or shared mailbox.
Choose the status words carefully
| Status | Use when | Evidence to cite |
|---|---|---|
| Under investigation | You have not finished checking | Date started |
| Not affected | Component absent, or code cannot be executed in the build | Justification label and analysis date |
| Affected | The vulnerable code can run in a shipped version | Affected versions and the action planned |
| Fixed | A release removes the issue | Fixed version and release date |
For not affected, the OpenVEX specification requires a justification label or an impact statement, so give one. For affected, it expects a statement of actions to remediate or mitigate.
Add a machine readable attachment
If the customer uses tooling, attach a VEX document with the same status. It lets them match your statement to their scan. CISA notes VEX can be authored by the supplier or a third party, but for your own product, issue it yourself.
Pitfalls
- Answering for a version you did not check. State the scope.
- Different words in different replies. Keep one vocabulary.
- Silence after the first reply. Send the promised update even if nothing changed.
- Using KEV as the only signal. Listing there raises urgency but does not tell you whether you ship the affected code.
Try it yourself
Click through it at your own pace, or open it full screen. Follow a new disclosure from alert to answer.
Quick check
Is it fine to say we are investigating?
Yes. It is a standard VEX status and the honest one until you have checked.
Should we reply if we do not use the component at all?
Yes, briefly, with the component absent justification and the date you checked.
Safeguard's zero-day discovery and reachability analysis help you reach a status quickly and keep the evidence. You can try the free scan.
Sources
- Minimum Requirements for VEX, CISA
- OpenVEX specification
- Known Exploited Vulnerabilities Catalog, CISA
Last reviewed: 19 October 2026.
