Hello Saptarshiamc,

I would recommend reconsidering adding approvals for the different states of the vulnerable item. The VR process scales beyond what is feasible via human interaction. My recommendation would be to utilize your vulnerability scanner as much as possible and allow it to determine whether the fix has been implemented and close out the vulnerable item automatically. 

If approvals are required for auditing visibility, you are able to launch and link the vulnerable item/remediation tasks to the ServiceNow Change Management module. I would believe that your approvals can be best captured there.

If you must proceed in this manner, I believe the approval rules in the VR module is able to handle these state change requests, however it would only return the vulnerable item to the previous state rather than the 'Open' state. To make this further change, it would require custom scripting to overwrite the ootb system.