Vulnerability Exploitability eXchange (VEX) Reporting Services

The contract requires the timely generation and delivery of Vulnerability Exploitability eXchange (VEX) reports within three days of identifying a software vulnerability, ensuring rapid response to security threats. Deliverables include a detailed analysis of exploitability, accurate mapping of vulnerabilities to standardized Common Vulnerabilities and Exposures (CVE) identifiers, and formatting all reports in machine-readable standards such as JSON or CSAF to support automated systems and interoperability across security platforms. The work is governed under a subcontract arrangement with a North American Industry Classification System code of 541690, indicating it falls under other professional, scientific, and technical services. This contract is issued by the U.S. Department of State through the U.S. Embassy in Phnom Penh, with the place of performance located in Phnom Penh, Cambodia. The solicitation was posted on April 24, 2026, and responses must be submitted by May 8, 2026, at 9:00 a.m. While no set-aside designation or point of contact is specified, the urgency of the 72-hour turnaround requirement underscores the critical nature of timely vulnerability communication for national and diplomatic cybersecurity operations. The use of standardized formats and precise mapping reflects a high emphasis on automation, scalability, and alignment with federal and international cybersecurity reporting protocols.