January 25, 2010: As Microsoft has released their "out-of-band" patch for the Internet Explorer vulnerability that was used in Operation Aurora (MS10-002) as well as a low amount of observed usage in the wild, we have lowered the threat condition to Severe. Users are still advised to confirm coverage for the vulnerability and all associated malware as well as deploy all relevant patches within a timeframe that complies with their risk management policy.
Critical
Systems worldwide are being widely targeted, or may become widely targeted by an active and available exploit or threat. An extreme global security incident is taking or may imminently take place.
Severe
An unpatched or recently patched vulnerability can be exploited by a worm, and systems worldwide are at risk to be targeted by a particular worm. No worm activity has been identified.
A high incidence of new malware that potentially can cause damage has been reported.
Elevated
An unpatched or recently patched vulnerability is present on many systems worldwide but requires user interaction to be exploited.
An existing vulnerability becomes more serious because new exploit code has been published.
There is new malware activity, but it is not widespread.
Low
There is no direct threat to systems that have been patched.
No new significant malware activity has been reported.