The CVSS 10 rating for this Exchange Online SSRF is technically accurate but functionally misleading if you're trying to understand your actual risk. The score treats this as an atomic vulnerability, but what you're actually dealing with is the third or fourth SSRF variant in Exchange's cloud deployment since 2021. Each one received a similar maximum-severity score, each was patched with URL validation fixes, and each left the underlying architectural surface intact. The pattern itself is the signal — not the score.
The more important question isn't whether this deserved a 10. It's whether the capability that created this attack surface should still exist. Exchange Online must fetch external content to function — inline images, preview generation, external resource rendering. Every legitimate feature requiring outbound connectivity creates potential SSRF surface area. When Microsoft patches a URL validation bypass in one of these features, they're affirmatively choosing to keep that capability running rather than deprecated. The patch is an architectural decision, not just a security fix.
For defenders, this means: your risk model should treat Exchange Online's external content fetching as a persistent attack surface, not a solved problem. Ask whether IMDS (Instance Metadata Service) access was ever reachable from the compromised component — that's the escalation path that transforms a single-tenant SSRF into infrastructure compromise. Check whether Azure-level network controls exist to limit what Exchange Online's backend components can reach. And critically, track not just whether this CVE is patched, but whether Microsoft has actually deprecated any external content fetching capabilities as a result. Past history suggests they patch the specific bypass and leave the architecture unchanged.
The knowledge gap isn't about unknown mitigations — denylisting internal IP ranges and metadata service ingress control have been standard guidance since 2019. The gap is structural: security lessons learned aren't reaching the product teams making feature decisions. That's a vulnerability class that no CVSS score captures.