The Common Vulnerability Scoring System is genuinely useful for communicating the severity of an individual, isolated finding. It was never designed to describe what happens when several findings are combined into a single attack path.
Three findings scored 3.1, 5.3, and ‘informational’ individually can chain into a 9.8-severity account takeover. If each finding is only ever evaluated on its own, that combined risk simply never shows up in a report.
This is why chained findings deserve their own, separately calculated severity — reflecting the realistic outcome of combining them, not just the sum of their individual, isolated scores.
