Vulnerability chaining

Several low-severity weaknesses can combine into a serious attack path. Assessing each vulnerability in isolation can therefore understate the risk.

the sequential exploit of multiple vulnerabilities in order to attack to attack a system, where one or more exploits at the end of the chain require the successful completion of prior exploits in order to be exploited.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology