Vulnerability chaining combines multiple lower-severity vulnerabilities to achieve a high-impact outcome that none could accomplish alone — e.g., SSRF + IDOR + misconfigured IAM = account takeover.
CVSS scores are individual. Chained attacks compound severity. Defenders should think about attack paths, not individual vulnerabilities. BloodHound finds AD attack chains. Manual pen testing excels at finding chains automated scanners miss. Patch chained vulns even if each individually seems low-severity.