Microsoft SharePoint Server Remote Code Execution Vulnerability

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Within a SharePoint site, the attacker must be authenticated, and they would need to have the “Use Remote Interfaces” and “Add and Customize Pages” permissions on a Policy Center site to be able to exploit this vulnerability.

What is the attack vector for this vulnerability?
In a network-based attack, the attacker must be authenticated to a SharePoint Online tenant associated with a hybrid deployment to tamper with data. This tampered data is synchronized down to the on-premises server and exploits the vulnerability. The attackers code will run in the context of the SharePoint timer service on the on-premises server.

Security updates
16.0.5404.1000 — https://support.microsoft.com/help/5002425
16.0.10400.20008 — https://support.microsoft.com/help/5002423
16.0.16130.20642 — https://support.microsoft.com/help/5002424