---
title: Microsoft now publishes VEX statements for all Microsoft-assigned CVEs | ctxsec
url: https://ctxsec.com/items/msrc-vex
description: ""
status: "confirmed (vendor)"
published: 2026-09-08
---

> 

[← Cybersecurity News](/news) · [markdown](/items/msrc-vex.md)

confirmed (vendor)

2026-09-08

### Microsoft now publishes VEX statements for all Microsoft-assigned CVEs

Since Sept 8, 2026, MSRC has published machine-readable CSAF VEX documents for every Microsoft CVE, extending the Azure Linux pilot from Oct 2025. Feed your scanner from msrc.microsoft.com/csaf/vex/ to cut false positives. It doesn't add any updates you have to deploy.

Sources: [MSRC blog](https://www.microsoft.com/en-us/msrc/blog/2026/09/toward-greater-transparency-expanding-machine-readable-vulnerability-exploitable-exchange) · [CSAF VEX directory](https://msrc.microsoft.com/csaf/vex/)