How Attackers Chain Small Vulnerabilities Into Major Breaches

On 19 January 2024, CISA issued its first emergency directive of the year. 

The cause was not one catastrophic bug but two flaws in Ivanti Connect Secure and Policy Secure VPN gateways: an authentication bypass (CVE-2023-46805) and a command injection flaw (CVE-2024-21887). Alone, each was a stepping stone. Chained together, they let attackers run commands on a gateway without logging in, move laterally, steal data, and plant backdoors. 

 

 

More than 16,200 exposed appliances were tracked, and a suspected state-backed group had backdoored over 2,100 of them, according to reports.

This is vulnerability chaining, and it is how many serious breaches actually happen.

 

 

What Vulnerability Chaining Means

Vulnerability chaining is the practice of linking several weaknesses, none necessarily critical on its own, into a path from the outside to something valuable. Tenable's analysis puts it simply: "A full system breach rarely happens through a single vulnerability."

 

The chain does not need to be exotic. Tenable cites a 2019 FBI flash describing a dozen vulnerabilities, mainly low- and medium-severity information disclosure flaws, used by the APT10 group against government and cloud providers. The attacker's skill lies in assembly, not in finding one perfect bug.

 

 

Anatomy of a Chain

Most chains follow four links.

Link	What the attacker needs	Ivanti example (2024)
Foothold	A way to reach the target	Authentication bypass on an internet-facing gateway
Execution	Control over the system	Command injection run through the bypass
Escalation and movement	More privilege, more reach	Lateral movement inside the network
Objective	Data, persistence, or disruption	Data theft and backdoors

The pattern is the same whether the links are software flaws, misconfigurations, or stolen credentials.

 

 

Case One: When the Patch Was Not the End

CISA's advisory on the Ivanti gateways warned that attackers could exploit the flaws "in a chain to bypass authentication" and execute commands with elevated privileges. Two details deserve attention.

 

First, persistence. CISA said a threat actor may be able to keep root-level access even after a victim performs factory resets. Second, verification. CISA found that Ivanti's integrity checker tool was "not sufficient to detect compromise," because attackers could deceive it. A clean result did not prove a clean device. The advisory told defenders to assume an attacker may maintain access and lie dormant.

 

The lesson: when a chain ends at an edge device, patching closes the door but does not tell you who is already inside.

 

 

Case Two: A Chain With No Software Bug at All

The 2019 Capital One breach shows that chains can be built from configuration. According to analysis published by CloudSEK, drawing on academic work, the path ran from a misconfigured web application firewall that let outside requests reach backend resources, to the cloud metadata service, which returned temporary credentials for an attached role, and then to storage that the role could read. Roughly 100 million people in the US and 6 million in Canada were affected.

 

The US Office of the Comptroller of the Currency imposed an $80 million civil penalty, citing a failure to establish effective risk assessment processes before moving significant data to the public cloud, and missed control weaknesses in internal audits. The exact technical mechanism has been described differently across sources, so treat the step-by-step detail as analysis, not settled fact. The shape is clear, though: a small misconfiguration, an over-permissive role, and a data store, none dramatic alone.

 

 

Why Scanners and Scores Miss Chains

A vulnerability scanner produces a list. A chain is a path. Three things hide the difference.

 

* Severity scores describe a flaw, not a route.
Tenable notes that CVSS was designed to describe a vulnerability's technical nature but has been misused as a prioritisation tool, and that scores do not show how a flaw fits into an attack chain or a specific environment. A "medium" that supplies the escalation step is worth more to an attacker than its score suggests.

* Mediums get deferred.
Tenable's warning is blunt: when "later" is the plan, it usually means "never."

* Speed favours the attacker.
Mandiant's M-Trends 2026 found exploits were the most common initial infection vector for the sixth consecutive year, at 32% of intrusions, and estimated mean time to exploit at about minus seven days, meaning exploitation often begins before a patch exists. Verizon's 2026 DBIR, as reported by Help Net Security, found vulnerability exploitation overtook stolen credentials as the top initial access vector for the first time, and only 26% of CISA's known exploited vulnerabilities were fully remediated, with a median of 43 days to full patch.

 

 

Finding Chains Before Attackers Do

1. Start from reachability. Map what is exposed to the internet, then what each exposed system can reach. A flaw on an isolated system and the same flaw on a gateway are different risks.

 

2. Rank findings by the role they play. Ask of every finding: could it give a foothold, execute code, escalate privilege, expose credentials, or reach sensitive data? Findings that fill a role in a plausible path move to the top, whatever their score.

 

3. Include misconfigurations, identity, and cloud permissions. Capital One's path contained no software exploit. Scan results alone will miss these links.

 

4. Use human testers to assemble paths. Tools find links, while chain-building is a reasoning task. In our view, this is where manual penetration testing earns its place, by showing which combinations lead somewhere. Red team testing then checks whether your detection would notice the walk.

 

5. Break the chain at the cheapest link. You do not have to fix everything at once. Patching, segmenting, removing a standing permission, or adding monitoring at the right point can cut off a whole path.

 

6. Assume compromise on edge devices after exploitation. The Ivanti guidance is explicit: patching is not proof of cleanliness. Hunt, rotate credentials, and rebuild where indicated.

 

7. Retest. A fix can open a new link. Confirm that the path is closed.

 

 

Where ILLUME Intelligence Can Help

ILLUME Intelligence's Vulnerability Assessment service finds and ranks weaknesses across your environment, our Penetration Testing service builds them into attack paths and shows what an intruder could actually reach, and our Red Team Testing service checks whether your people and tools notice the chain in progress. A short exposure review of your internet-facing systems is a practical place to start.

 

The Bottom Line

Breaches rarely depend on a single brilliant exploit.

They depend on small gaps lining up, and on defenders who judged each gap in isolation. Judge findings by the path they sit on, close the cheapest link that breaks it, and test the result the way an attacker would.

---

Comments

---

No Comments Found.