CVE-2021-1636 security update for SQL Server

Microsoft just released this security update CVE-2021-1636 for a Security Vulnerability. Not much information is available at the moment. Any input on the following points will be highly appreciated - How critical is this update. Do we need to apply this update as soon as possible? - If the SQL server is not available over internet, will it still be vulnerable? We generally apply updates on Test environments and wait for a month before moving to production if no problem is found. But since we have limited information available for this update, is someone planning to install this update on production servers soon considering it could be critical? TIA.