Exploit Chain — Glossary

The longer version

Each step gives the attacker something the next step needs. A bypass gets access, a second flaw runs a command, a third raises privileges. A flaw that looks minor alone may be the missing link.

Chains are why per-flaw scores can mislead. Defenders may rate each part as medium while the combination gives full control. Breaking any one link can stop the attack, so fixing the entry point and limiting what the later steps can reach both help.

In January 2024, attackers chained two Ivanti Connect Secure flaws, CVE-2023-46805, an authentication bypass, and CVE-2024-21887, a command injection, to run commands on VPN appliances without logging in.

When you read an advisory, look for related CVEs, ask what else a flaw enables and treat a medium flaw that sits next to a critical one as critical.

Where we use “Exploit Chain”

CybersecurityCitrix and Ivanti Edge Zero-Days: What to Patch Now
Citrix NetScaler and Ivanti Connect Secure were exploited before fixes existed, and NetScaler's 4 October fix builds are still affected by a later SAML flaw on appliances acting as an identity provider. Here are the builds to move to by 6 November and how to check for compromise.
Nov 1, 2026Key term

The longer version

Where we use “Exploit Chain”

Get the Core in your inbox.