Microsoft's record Patch Tuesday shows why severity can't decide what gets patched first

The two flaws attackers were already exploiting when Microsoft’s September 8 Patch Tuesday landed were both rated Important by Microsoft. Both are local elevation-of-privilege vulnerabilities. An attacker who can run low-privilege code on the machine can elevate to SYSTEM privileges.