The vulnerability is caused by improper handling of errors or exceptional conditions in HCL BigFix AEX. When these error paths are triggered, stack traces, system details, and internal paths are exposed, allowing an attacker to gather sensitive technical information that could facilitate further exploits. The weakness is classified as Information Exposure Through Error Messages (CWE-209), Loss of Data Confidentiality (CWE-391), and other information leakage (CWE-755).

The affected product is HCL Software BigFix AEX. Version information is not specified in the advisory, so all installations of BigFix AEX should be considered potentially vulnerable until a confirmed patch is applied.

The CVSS score for this issue is 6.5, indicating a medium severity. The EPSS score is not available, so the current risk of exploitation cannot be quantified, but the lack of a KEV listing suggests there are no known widespread attacks. The likely attack vector is from remote access that triggers error conditions, such as web or API requests that cause the application to produce detailed error responses. An attacker with such access could use the disclosed stack traces or internal paths to identify further entry points or privilege escalation opportunities.