The list was compiled by federal security agencies in the US, the UK, and Singapore, as well as leading security software vendors and consulting firms; the top university-based security programs; many other user organizations; and the SANS Institute.

"Although there are thousands of security incidents each year affecting these operating systems, the overwhelming majority of successful attacks target one or more of these vulnerable services," notes the SANS Institute. "Attackers are opportunistic. They take the easiest and most convenient route and exploit the best-known flaws with the most effective and widely available attack tools. They count on organizations not fixing the problems, and they often attack indiscriminately, scanning the Internet for any vulnerable systems. The easy and destructive spread of worms, such as Blaster, Slammer, and Code Red, can be traced directly to exploitation of unpatched vulnerabilities."

The SANS list "is a living document. It includes step-by-step instructions and pointers to additional information useful for correcting the security flaws," notes the site, which welcomes suggestions from readers. For details on why these services are targeted as top vulnerabilities, and tips on improving security, see the SANS web site.