In vulnerability management, applicability is the question of whether a vulnerability affects a specific product, version, configuration, or deployment. A flaw may have a high severity score, but if the vulnerable component is not present-or the affected feature is not enabled-it may not apply to that system.
Applicability matters because severity scores and exploit reports do not establish local exposure on their own. Defenders check software inventories, versions, configurations, and deployment details to determine whether a flaw is present and reachable. VEX data can communicate this status in a machine-readable form. Confirming applicability helps teams prioritize real exposure, document decisions, and avoid spending effort on vulnerabilities that do not affect their environment.