CVE-2021-34473 is a pre-authentication remote code execution vulnerability in Microsoft Exchange Server's Unified Messaging service, patched in March 2021 alongside CVE-2021-26855 (the SSRF that preceded it in the Hafnium attack chain). The CVSS score of 9.1 is severe but unremarkable — what makes this CVE analytically significant is its EPSS score approaching 1.0, a ceiling it shares with its related Exchange vulnerabilities.
The near-certain EPSS score does not reflect exploitation predictability or obviousness — commit history shows these were buried code paths in complex request parsing logic, not trivially discoverable flaws. What the EPSS ceiling actually measures is two things defenders must internalize:
First, blast radius. Exchange Server sits at the organizational nervous system — authentication, email routing, external-facing attack surface for every user. An unauthenticated RCE here doesn't compromise a service; it compromises the organization's communication backbone. The model converges toward certainty because the exploitation outcome is structurally guaranteed by the target's position, not because the vulnerability was obvious.
Second, remediation debt. The Hafnium exploits weaponized within days of patch release. The EPSS ceiling reflects not just that exploitation was likely, but that thousands of organizations would remain unpatched for weeks or months afterward — accumulating exposure across an attack chain they couldn't close fast enough.
The Exchange vulnerability cluster recurs every 18-24 months (CVE-2012-0002, CVE-2014-2113, CVE-2015-1635, CVE-2018-7961, CVE-2020-16875, then the Hafnium cluster). This is not coincidence — it's the expected output of high-complexity, backward-compatibility-constrained code that accumulates "exploitable sediment" in frozen maintenance paths. The attack surface between protocol handlers, authentication state machines, and request parsing logic creates interaction points that remain invisible until triggered.
For defenders, the actionable implications are concrete. If you run on-prem Exchange, treat any new critical Exchange CVE as an emergency regardless of EPSS — the model is reflecting blast radius certainty, not prediction. More critically, examine your remediation timelines: the next Exchange RCE will hit the same population of organizations that couldn't patch fast enough last time. Your defensive posture should prioritize rapid deployment capability and assume a weaponized window measured in days, not weeks. The EPSS ceiling is telling you that the exploitation is already happening — the question is whether you're still in the exposure window.