---
title: Request an exception for a vulnerable item
description: Request an exception for a vulnerable item \(VI\) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/raise-exception-vi.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Requesting and approving an exception, Vulnerability Response remediation overview, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Request an exception for a vulnerable item

Request an exception for a vulnerable item \(VI\) that can’t be remediated immediately. For example, as a remediation owner, you can request an exception if a patch isn’t available for a machine.

## Before you begin

Role required: sn\_vul.remediation\_owner

## About this task

**Important:** You can request exceptions from the Vulnerability Manager and IT Remediation Workspaces. For more information, see [Request exceptions for remediation tasks and records in the Vulnerability Manager Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-manager-workspace/vr-ws-exceptions-split-VMGR-ws.md) and [Request an exception in the IT Remediation Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/it-remediation-workspace/vr-ws-request-exception.md).

You can also request exceptions for VIs in the classic environment.

**Note:**

Starting from v21.0 of Vulnerability Response, you can configure the time frames for approving false positives and exceptions, along with email notifications for both the approver and requester after a set number of days. When a request is raised, the vulnerable item changes to In-Review status and a state change record is created. If the approver doesn't respond within the configured time frame, the vulnerable item or remediation task reverts to Open status. The previous state is stored in the **backup\_state** field. For more information, see [Configure approval rules for Exception Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/exception-mgt-approval-rules.md).

## Procedure

1.  Navigate to **Vulnerability Response** > **Vulnerable Items** > **All**.

2.  Select the item that you want to request an exception for.

    The selected item must be in Open, Under Investigation, or Awaiting Implementation state.

3.  On the Vulnerable Item form, click **Request Exception**.

4.  If Vulnerability Response is selected in the Exception Management screen, fill in the fields in the Request Exception form.

<table id="table_kxh_gh2_4lb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Until

</td><td>

Date on which the exception request expires. This date must be within the duration selected in the **All** &gt; **Vulnerability Response** &gt; **Administration** &gt; **Exception Management** screen.When the exception request expires, the group reverts to the Open state.

**Note:** Starting with version 18.0 of Vulnerability Response \(VR\), if a vulnerable item was deferred for remediation by using the exception management feature, then in case it is reopened by the scanner, the deferral date set on the vulnerability will still persist. To enable this functionality, set the value of the system property **sn\_vul.auto\_defer\_vit\_in\_active\_exception\_window** to true. Also, the deferred **Until** date persists even after the vulnerable item gets closed or the exception expires. The role required is sn\_vul.manage\_exception\_configuration for both read and write.

</td></tr><tr><td>

Reason

</td><td>

Reason for the request. Choices are:-   Risk Accepted
-   Awaiting Maintenance Window
-   Fix Unavailable
-   Mitigating Control in Place
-   Other
To see how to add new reason choices, see [Define policy reason mapping](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/define-policy-reason-mapping.md).

</td></tr><tr><td>

Additional information

</td><td>

Details that are related to the reason why this request is being made. This required field is to be updated by the remediation owner.

</td></tr></tbody>
</table>5.  Submit the exception request by clicking **Request Approval**.


## Result

The state of the vulnerable item changes to In Review. Use the **State Change Approval** tab to track the status of the exception request.