diff --git a/src/i18n/locales/en.json b/src/i18n/locales/en.json
index 975a1f749..0e0bcbfb1 100644
--- a/src/i18n/locales/en.json
+++ b/src/i18n/locales/en.json
@@ -1151,6 +1151,7 @@
     "vulnerability_updated_desc": "The date the vulnerability record was last updated",
     "vulnerability_vuln_id": "Vulnerability ID",
     "vulnerability_vuln_id_desc": "The identifier which uniquely identifies this vulnerability within the same source",
+    "vulnerability_id_pattern_tooltip": "Use * as wildcard (e.g., CVE-2024-* or MAL-*) or regular expressions (e.g., ^CVE-202[34]-.*)",
     "vulnerable": "Vulnerable",
     "vulnerable_components": "Vulnerable Components",
     "vulnerable_projects": "Vulnerable Projects",
diff --git a/src/views/policy/PolicyCondition.vue b/src/views/policy/PolicyCondition.vue
index 368e96e97..1938ff746 100644
--- a/src/views/policy/PolicyCondition.vue
+++ b/src/views/policy/PolicyCondition.vue
@@ -328,6 +328,12 @@ export default {
         { value: 'MATCHES', text: this.$t('operator.matches') },
         { value: 'NO_MATCH', text: this.$t('operator.no_match') },
       ],
+      objectAndRegexOperators: [
+        { value: 'IS', text: this.$t('operator.is') },
+        { value: 'IS_NOT', text: this.$t('operator.is_not') },
+        { value: 'MATCHES', text: this.$t('operator.matches') },
+        { value: 'NO_MATCH', text: this.$t('operator.no_match') },
+      ],
       numericOperators: [
         { value: 'NUMERIC_GREATER_THAN', text: '>' },
         { value: 'NUMERIC_LESS_THAN', text: '<' },
@@ -503,7 +509,7 @@ export default {
           this.operators = this.listOperators;
           break;
         case 'VULNERABILITY_ID':
-          this.operators = this.objectOperators;
+          this.operators = this.objectAndRegexOperators;
           break;
         case 'VERSION_DISTANCE':
           this.operators = this.numericOperators;
@@ -744,6 +750,11 @@ export default {
       switch (this.subject) {
         case 'AGE':
           return this.$t('message.age_tooltip');
+        case 'VULNERABILITY_ID':
+          if (this.operator === 'MATCHES' || this.operator === 'NO_MATCH') {
+            return this.$t('message.vulnerability_id_pattern_tooltip');
+          }
+          return '';
         default:
           return '';
       }