[In addition to the accepted answer] Since you mentioned an official report, It would be a good idea to classify the impact of this vulnerability into two categories: Technical Impact and Business Impact.
The technical impact would help people who would want to develop a defense against the issue. The business impact would be for the consumption of the executives and decision makers as it should help them prioritize the fix or a compensating control. In case you are presenting this report to an audience containing execs, having a business impact section helps to convey the right message.
Some of the points to consider while evaluating the business impact are:
- Business criticality of the affected application/machine
- Number of users getting affected
- Nature of data at risk
- Exposure to external network
- Overall impact on the business processes.