---
title: Application Vulnerable Item fields
description: Application vulnerable items \(AVITs\) are automatically created during third-part vulnerability integration imports.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/avm-vul-items-fields.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: reference
last_updated: "2026-03-12"
reading_time_minutes: 4
breadcrumb: [Reference, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Application Vulnerable Item fields

Application vulnerable items \(AVITs\) are automatically created during third-part vulnerability integration imports.

## Application vulnerable item fields

Except for the **Assignment group**, **Assigned to** fields and **Notes**, all other fields in the AVIT are read-only.

<table id="table_t4d_4bd_5s"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Number

</td><td>

Automatically generated AVIT identifier for this record.

</td></tr><tr><td>

Scan type

</td><td>

Type of scanner that found this AVIT. Choices are:

-   Dynamic
-   Static
-   SCA

</td></tr><tr><td>

Risk rating

</td><td>

Quantified **Risk Score** separating vulnerable items into Critical, High, Medium, Low, and None. For more information on risk ratings, see, [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-calculators-rules.md).

</td></tr><tr><td>

Risk score

</td><td>

Calculated amount of risk the AVI poses to your environment.

 For more information, see [Calculate risk in Application Vulnerability Response automatically](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-calculators-rules.md).

</td></tr><tr><td>

Remediation commitment date

</td><td>

The date AVITs should be remediated after it is moved into **Under Investigation**. This field only appears if the AVIT is in **Under Investigation**.

</td></tr><tr><td>

Remediation target

</td><td>

Date by which the AVITs should be remediated, since first identified. Only appears when applicable.For more information on remediation targets, see [Automate remediation target tracking in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-time-to-remediate-rules.md).

</td></tr><tr><td>

Remediation status

</td><td>

Status of the remediation for the AVIT. It is determined by the AVIT with the nearest due date, when applicable.

 States include:

-   In-flight
-   Approaching Target
-   Past Target

</td></tr><tr><td>

Category Name

</td><td>

Name of the category of the vulnerability.

</td></tr><tr><td>

Vulnerability

</td><td>

ID of the vulnerability associated with this application vulnerable item.

</td></tr><tr><td>

Application release

</td><td>

Version of the application.

</td></tr><tr><td>

Application module

</td><td>

Affected application in DAST scan. Hidden for SAST scans.

</td></tr><tr><td>

LocationVersion 14.0: SAST

</td><td>

DAST: URL location of the vulnerability within the application.

 SAST: File path and line number of the vulnerability within the application.

</td></tr><tr><td>

State

</td><td>

This field defaults to **Open** when created. See [Application Vulnerable Item \(AVI\) states](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-states.md) for more information on how states are mapped.

</td></tr><tr><td>

Reason

</td><td>

\[Only visible when the AIV is in the **Closed** state.\] Explanation of the State.

</td></tr><tr><td>

Assignment group

</td><td>

Group selected to work on this AVIT. Can be manually added or edited by an App-Sec Manager.

</td></tr><tr><td>

Assigned to

</td><td>

Individual from the selected assignment group that works on this AVI. Can be manually added or edited by an App-Sec Manager

</td></tr><tr><td>

First found

</td><td>

Date the third-party source first found the application vulnerable item.

</td></tr><tr><td>

Last found

</td><td>

Date the third-party source last found the application vulnerable item.

</td></tr><tr><td>

Closed

</td><td>

\[Only visible when the AVIT is in the **Closed** state.\] Date the AVI was closed.

</td></tr><tr><td>

Closed by

</td><td>

\[Only visible when the AVIT is in the **Closed** state.\] Entity that closed the AVIT.

</td></tr><tr><td>

Summary

</td><td>

Imported description of the vulnerability.

</td></tr><tr><td colspan="2">

**Findings** Read-only data imported from third-party integration.

</td></tr><tr><td>

Source AVIT ID

</td><td>

Imported identifier for the source AVIT.

</td></tr><tr><td>

Source severity

</td><td>

Imported severity from the source application.

</td></tr><tr><td>

Source target fix date

</td><td>

Imported date by which the source expects the AVIT to be remediated.

</td></tr><tr><td>

Source mitigation status

</td><td>

Imported mitigation status from the source application.

</td></tr><tr><td>

Source remediation status

</td><td>

Imported remediation status from the source application.

</td></tr><tr><td>

Source finding status

</td><td>

\[Only visible when populated\] Imported issue status from the source application.

</td></tr><tr><td>

SDLC status

</td><td>

Imported Software Development Life Cycle status.

</td></tr><tr><td>

Complies with Policy

</td><td>

Imported compliance status. If not status is provided, this field is set to **Not Applicable**.

</td></tr><tr><td>

Source link

</td><td>

URL to the source AVIT.

</td></tr><tr><td>

Source notes

</td><td>

Imported notes from the source.

</td></tr><tr><td>

Vulnerability summary

</td><td>

Imported summary from the source.

</td></tr><tr><td>

Vulnerability explanation

</td><td>

Imported explanation from the source.

</td></tr><tr><td>

Recommendation

</td><td>

Imported recommendation from the source.

</td></tr><tr><td>

References

</td><td>

Imported references from the source.

</td></tr><tr><td colspan="2">

**HTTP Request/Response \(only visible for DAST scans\)**

</td></tr><tr><td>

Source request

</td><td>

HTTP request

</td></tr><tr><td>

Source response

</td><td>

HTTP response

</td></tr><tr><td colspan="2">

**Notes**

</td></tr><tr><td>

Remediation Plan

</td><td>

Details for how the AVITs will be remediated. The plan should be implemented by the **Remediation commitment date**. This field only appears if the AVIT is in **Under Investigation**.

</td></tr><tr><td>

Additional comments/Work notes

</td><td>

Any relevant information. Select the text box for Work notes to add information.Starting with Vulnerability Response v20.0, you can add work notes in the Notes section for a deferred application vulnerable item.

</td></tr></tbody>
</table>Age calculations for an AVIT:

-   The Age column in the AVIT list displays the duration \(format: Days HH:MM:SS\) for which an AVIT is active. The Age value is zero for a closed AVIT.
-   The Age closed column in the AVIT list displays the duration \(format: Days HH:MM:SS\) for which an AVI is active before it is closed. For a AVITs, other than in the Closed state, the Age closed value is zero.

For more information on how to customize the calculation of Age and Age closed durations, see the [KB1703270](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1703270) article.