Vulnerability Exploitability eXchange (VEX) Reporting

The contract requires the production and timely delivery of VEX reports within three days of identifying a vulnerability to support assessments of exploitability and facilitate coordination with security agencies. This subcontract is issued by the U.S. Embassy Pretoria under the Department of State, with performance to be carried out in Johannesburg. The work falls under NAICS code 541690, indicating it involves other scientific and technical consulting services, and is intended to enhance the speed and accuracy of vulnerability response through standardized, rapid reporting. Timeliness is critical, as delays could impact threat mitigation efforts and interagency collaboration. The solicitation was posted on July 31, 2026, with a response deadline of August 12, 2026, leaving a narrow window for interested parties to submit proposals. There is no set-aside designation specified, and the contract does not include detailed contact information or a formal office address beyond the place of performance. The focus is strictly on delivering actionable VEX documentation that aligns with federal security protocols, enabling informed decisions regarding risk, patch prioritization, and coordinated disclosures with relevant security entities.