When applying a cumulative patch to EAP7, new, "patched" JAR files are placed under the .overlays directory and are active for EAP7 from this location. Older, replaced JAR file still reside in their original locations on the file system within the container. Vulnerability scanners, such as Twistlock, will report "false positives" for these older replaced JAR files that aren't actually active and being used.

This also makes sense from a slimming perspective. We are leaving wasted space in the containers.