Is CVE-2024-23568 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23568 being exploited in the wild.

How severe is CVE-2024-23568?

Medium severity, with a CVSS score of 5.3, published 17 July 2026.

Which products and versions are affected?

HCL Software Aftermarket EPC 1.0.0.

Is there a fix for CVE-2024-23568?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-23568 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-23568?

Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23568: HCL Aftermarket EPC information disclosure via server version leakage

CVE-2024-23568 · Severity: medium · CVSS 5.3 · Published 2026-07-17

HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, is leaking its internal server software version information to the public internet. While this does not directly grant access to data, it provides attackers with a roadmap of the system's specific technologies and potential weaknesses. This information significantly simplifies the process for a malicious actor to identify and launch targeted attacks against the infrastructure.

Technologies: HCL Software Aftermarket EPC. Vendors: HCL Software.

Quick answers

Is CVE-2024-23568 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23568 being exploited in the wild.
How severe is CVE-2024-23568?: Medium severity, with a CVSS score of 5.3, published 17 July 2026.
Which products and versions are affected?: HCL Software Aftermarket EPC 1.0.0.
Is there a fix for CVE-2024-23568?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-23568 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23568?: Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HCL Aftermarket EPC version 1.0.0 is affected by an information exposure vulnerability (CWE-200) where the web server reveals its software version in HTTP response headers or error pages. This is a passive reconnaissance vulnerability reachable over the network without authentication. By identifying the exact version of the underlying server software, an attacker can cross-reference known CVEs for that specific version to facilitate further exploitation. The vulnerability is addressed in HCL's security bulletin KB0132294.

Affected products

HCL Software Aftermarket EPC 1.0.0

Timeline

2026-07-17: advisory: NVD publication date

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.