Even after upgrade of AP a vulnerability detection

Products

• Automation Point

Issue/Introduction

If upgrading Automation Point to a release, service pack, or patch to resolve the Log4j vulnerability issue and it's possible to still getting flagged on a scan detecting the old version of Log4j specifically the following two files:

C:\Program Files (x86)\CA\CA Automation Point\Backup\patch\Classes

caapnfy.war & ca-nim-sm.war

Is it allowed to delete this older version?

Environment

Release : 11.7

Resolution

If upgrading to a valid service pack, patch or release of AP to resolve the vulnerability issue, there is taken a backup of the old environment.. 
This is done to go back to the previous installed version, when needed.
Checking the library that holds these war files, you will see it's a BACKUP directory:

C:\Program Files (x86)\CA\CA Automation Point\Backup\patch\Classes

If the new version is working well, it's possible to delete this directory, or only these 2 files... No problem to remove them...