“CERT/CC allows public release of SMTP smuggling, since no software vulnerabilities were identified ("it’s not a bug, it’s a feature")”
Outbound and inbound mail servers disagree on where a message ends, so an attacker can tack a second, spoofed email onto the first and it passes SPF. Through Exchange Online that meant mail from any domain that sends with Microsoft. Microsoft rated it moderate. Cisco’s Secure Email Gateway accepts the bad sequence by default for around 40k domains, and Cisco calls that a feature.