Severity Level Changes

Microsoft has modified the severity levels for reporting vulnerabilities in its products by adding a new “important” rating, and removing sub-criteria related to the type of server (Internet or internal) server or client system. The removal of the sub-criteria simplifies the definitions, and likely means that more vulnerabilities are rated “important” or “moderate,” rather than “critical.”

Rating	New Definition	Previous Definition
Critical	A vulnerability whose exploitation could allow the propagation of an Internet worm, such as Code Red or Nimda, without user action (such as opening a message attachment).	Internet Servers	Web site defacement, denial of service, or full control.
		Internal Servers	Elevation of privileges, data disclosure, or modification; auditing difficult.
		Client Systems	Run arbitrary code without user action; remote escalation of privilege.
Important	A vulnerability whose exploitation could result in compromise