Only one of the three core announcements released on the same day is rated as serious, what does the grading look at?
Read this set of real announcements first. A CMS released three core security announcements on the same day of 2026-10-14: SA-CORE-2026-014 was classified as critical (Critical), and it is a remote code execution issue in the field interface module;SA-CORE-2026-015 and SA-CORE-2026-016 are only rated as moderately critical, and are related to cross-site scripting issues related to tagging and attribute purification.On the same day, three core announcements were made, but only one was deemed severe. The reason is not the release schedule, but the criteria for dividing the security level - how is the security level divided? It is exactly the following three things: the security level measures who, from where, and how much damage this problem can cause, not how many recent events have occurred.On the same day, only one of the three announcements was classified as severe, which is exactly the normal output of this口径.
The classification reads the accessibility
The highest level, with common features pointing to accessibility: can be triggered without login, remotely accessible over the network, and upon hitting, it gains server-level control. The reason why remote code execution is always at the top of the level list is that it upgrades 'the website being hacked' to 'the entire machine being taken over', and all the databases, internal services, and backup files running on the same server are also compromised. Intermediate-level issues often fail in the aspect of accessibility: either requiring logged-in users with specific roles, or triggering the configuration combination of the dependent site, with the impact limited to page display and user session layers.
How does the premise of permissions affect the priority
The permission requirement is a demerit item in the grading, but it only 'reduces the probability', not 'exempts from punishment'. It requires a vulnerability triggered by permission, and the attacker must first obtain an account, which increases the initial cost and reduces the probability of actual exploitation, thus lowering the level; however, once the site exists with weak passwords, credential leaks, or internal account abuse, this premise is as if it does not exist. Therefore, the order of handling should be rearranged according to 'whether your site meets its premise': A medium-level vulnerability requiring administrator privileges may be more critical to you if the background is long-term exposed to the public network and the password policy is loose than a severe vulnerability requiring special configuration.
Process in order of priority
| Level signal | Decision points | Typical handling window |
|---|---|---|
| Severe | Unauthorised remote access, can obtain server control | Immediate mitigation, complete restart mitigation or virtual patch by the same day |
| High | Low privileges or user interaction required, impact across the entire site | Upgrade within one week, tighten exposure during this period |
| in | Specific permissions or specific module enabled required | Upgrade with the next maintenance window |
| Low | Limited information leakage, incomplete exploitation chain | Merged into regular update rhythm |
Outside the window, there are two things that must be done: implement all mitigation measures as specified in the notice (restart each process individually if required), and check credentials after the event regardless of the level, to see if the attack has already occurred, look at access logs and abnormal accounts, not the level of the vulnerability.
How to write your own announcement
It feels more intuitive compared to your own system. AnQiCMS publicly addressed two high-risk issues in the v3.6.6 fix list: SQL injection in list sorting parameters, and login credentials being forgeable when switching sites (the fix introduced a one-time ticket mechanism).The characteristic of this announcement is consistent with the above criteria -- not only did it write 'Fixed two bugs', but also provided subsequent actions: rotate the full-site request signature key (only perform the rotation action, the key value does not fall into any text), and modify the administrator's password as well.High-risk repair with credential rotation recommendation, exactly the way of 'level to be achieved action': A system that has been exploited should only close future entry points when patches are applied, not recall the credentials that have already flowed out.
The skill of another level lies in the default posture. The vulnerability grading teaches post-event sorting, and what can be done before is to narrow down the paths that can be triggered: The MCP interface of AnQiCMS sets the exposure range according to the intent domain, and operations such as backup, upgrade, and multi-site are set to DefaultOff by default at the whole-site level, which can only be used after explicit enablement; The defense against SQL injection and XSS at the system level relies on built-in mechanisms (JWT authentication, content sensitive word filtering, and anti-crawling interference code belong to this defense line), rather than relying on each developer to supplement individually. With fewer paths that can be triggered, the number of announcements naturally decreases.
Common questions
What if the announcement only indicates the level without specifying the trigger conditions, how can we estimate the risk?In addition to the level, we should prioritize three pieces of information: whether certification is required, which versions are affected, and whether related features are enabled under the default configuration; if all three are missing, handle conservatively according to the lower limit of the level and wait for subsequent updates.
Can we temporarily not deal with intermediate vulnerabilities?It is possible to delay the window, but it is not recommended to cancel the handling. The premise is that the probability discount is not immune, and once there is a gap in the account system, intermediate issues will be repriced.
Does it mean the system is not safe if there are multiple announcements in one day?Answer: The number reflects the activity of the disclosure mechanism, which does not directly equal the risk level. A more differentiated question is: Are there any unauthorized reachable remote execution issues in these announcements, and how many days were there between the release of the fix and the announcement.