Most vulnerability reports list findings in isolation — a low-severity issue here, a medium one there — each scored as if it exists in a vacuum. In practice, attackers don’t think that way.
An exploit chain connects individually minor issues into something serious: a leaked session identifier combines with a permissive endpoint, which combines with a missing authorization check, and suddenly you have full account takeover. None of the three steps looks critical on its own.
This is why chained findings deserve their own severity conversation, separate from the individual CVSS scores that feed into them. A report that only lists isolated findings can understate real business risk significantly.
