One of my observations is that a specific Exception Rule in ServiceNow Vulnerability Response was supposed to expire on 24 June 2025. However, a new Vulnerable Item (VIT1XXXXX) created this month still went into Deferred state, and it appears to have been deferred because of this expired exception rule.
A similar issue is happening with another exception rule (valid until 30‑09‑2025) which is also still marking new VITs as Deferred, even though the expiry date has passed.
This suggests that ServiceNow VR is continuing to apply expired exception rules to new VITs, causing them to inherit a Risk Accepted / Deferred state even when the exception should no longer be active.
