HCL Aftermarket DPC is vulnerable because it incorporates components that are known to be outdated or vulnerable, a weakness represented by the Use of Vulnerable/Outdated Versions flaw. An attacker could leverage publicly available exploits for those components and craft attacks that target the application itself. The impact could include loss of system functionality and possible exposure of organizational data. This flaw is classified as CWE‑1104.

The affected product is HCL Aftermarket DPC, version 1.0.0 and earlier releases that contain the vulnerable components. The product is distributed by HCL Technologies and delivered as a cloud‑based service, potentially impacting any deployment of this application.

The CVSS score of 2.6 indicates low to moderate severity. EPSS data is not available, so the prevalence of active exploitation cannot be determined, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, using exposed application interfaces to trigger known exploits against the underlying components. Overall risk remains low to moderate unless a high‑impact exploit is discovered for the specific component version in use.