CVE-2021-27065 was an SSRF in Microsoft Exchange's Unified Messaging service that could be chained to achieve remote code execution. The vulnerability mechanics are well-documented, but the exploitation dynamics revealed structural truths that matter more than the CVE itself: the pre-patch exploitation window was near-certainty, and defenders had no signal from traditional vulnerability management timelines because the attackers were already inside before disclosure.
The EPSS score of 0.99946 confirmed empirically what the attack pattern demonstrated: internet-facing Exchange servers were mass-compromised within days, with Hafnium establishing footholds in over 70,000 organizations before patches existed. This wasn't a race condition — it was an amplification event. The same foothold infrastructure that served espionage operations was subsequently repurposed by ransomware operators at zero additional access cost. The cascade was multiplicative, not additive.
What makes this CVE categorically different from generic RCE vulnerabilities is the combination of pre-patch exploitation and the organizational position of the target. Exchange sits at the intersection of identity infrastructure, direct Active Directory integration, and direct mailbox access — the same features that make it enterprise-critical are what made SSRF-to-RCE catastrophic. Compensating controls (DLP, network segmentation, EDR) have materially different efficacy against an attacker who already has pre-patch access to the mailbox server.
The analytical shift required: treat the pre-patch window not as a variable to optimize but as a loss condition to manage. When SSRF appears in Exchange's request handling pipeline, treat RCE follow-on as inevitable and foothold commoditization as structural. The Hafnium-to-ransomware transition wasn't coincidence — it's a documented pattern (Stuxnet progeny, Equation Group tools) where espionage-caliber access, once demonstrated, predictably migrates to criminal markets within days.
The CVSS 7.8 rating encodes defender assumptions about patch timelines that the empirical record disproved. That rating gave risk committees a plausible justification for multi-day patching latency on internet-facing servers — exactly the wrong signal for a near-certainty exploit. Severity models calibrated for deliberation timelines don't reflect the actual threat environment.
For practitioners: internet-facing Exchange deployments should be treated as Tier-0 patching priority regardless of CVSS score when SSRF patterns emerge in this request pipeline. Assume follow-on exploitation is inevitable, not possible. Post-patch, model the residual access debt — Hafnium footholds that persist unpatched across heterogeneous environments represent inventory awaiting liquidation by downstream actors. The next SSRF in Exchange won't be CVE-2021-27065; it'll be a new CVE exploiting the same forgotten code layer beneath 'mature, stable' features that nobody audits because they work.