Chained vulnerabilities are two or more flaws that an attacker combines so one bug creates the conditions for the next. For example, a routing mistake might steer a request into an unexpected handler, and a separate SQL injection flaw might then use that path to reach sensitive data or alter application state. Alone, each issue may look limited; together, they can produce outcomes such as authentication bypass, data theft, or remote code execution.
This matters because defenders cannot judge risk by counting CVEs one by one. A low-severity bug can become critical when it connects to another weakness in core code, APIs, plugins, or network services. In practice, attackers look for attack paths that turn a small input-validation or routing error into a pre-auth exploit chain, while defenders break those paths by patching every link, checking exact software versions, reviewing logs for abnormal request sequences, and hardening the exposed interface that joins the flaws.