A VEX statement carries exactly one of four statuses: not_affected, affected, fixed or under_investigation. This post covers the three that are not "not affected". Each one tells you something different about what to do next, and the specs attach different obligations to the author who writes them.
affected means the author recommends action
CISA's minimum requirements say that "affected" means actions are recommended by the author to remediate, mitigate or otherwise address the vulnerability, and that the vulnerability affects the listed products. A statement with this status must include an action statement.
OpenVEX says the same thing in its own terms: an affected statement needs an action statement describing remediation or mitigation. If you receive "affected" with no action text, treat the document as incomplete and ask the supplier.
fixed means the listed products contain the fix
"Fixed" means the listed product identifiers contain fixes for the vulnerability. The key word is listed. A fixed statement for version 2.4.1 says nothing about 2.4.0.
When you consume a fixed statement, check that the product identifier matches the exact build you run, not just the product name. A supplier may fix one branch and leave another open.
under_investigation is a promise to come back
CISA describes this status as the author or other relevant parties investigating without having declared a final status. It is expected to change once the investigation concludes.
That makes it a poor place to park a finding permanently. If a statement sits in under_investigation for weeks, ask the supplier for a date. It is a legitimate early signal, but it is not an answer.
How a consumer should treat each status
| Status | Your default action |
|---|---|
| affected | Read the action statement, schedule mitigation or upgrade |
| fixed | Confirm your version is in the fixed set, then upgrade |
| under_investigation | Keep the finding open, set a follow up date |
None of these statuses suppresses a finding. Only not_affected does that, and it needs a justification or an impact statement behind it. See how a not_affected statement must be explained.
No default status exists
CISA states that VEX does not specify, assume or imply any default status that is not explicitly provided in VEX statements, and that VEX information may be incomplete. Silence is not "not affected". If a supplier publishes statements for ten CVEs and your scanner reports eleven, the eleventh is still open.
Quick check
Does "fixed" mean every version of the product is safe?
No. It means the listed product identifiers contain the fix. Versions outside that list are not covered by the statement.
Can under_investigation be used to hide a finding?
It should not be. The status is expected to change when the investigation ends, so treat it as an open finding with a follow up date.
Safeguard's free scan at https://gold.safeguard.sh/scan can show you which components in your dependency tree carry open findings, so you know which VEX statements to ask for.
Sources
Last reviewed: 19 October 2026.
