Cybersecurity glossary
What is an Exploit Chain?
Learn what an exploit chain is, how attackers combine multiple weaknesses into one intrusion path, why single CVEs understate risk, and how defenders break chains with layered controls.
Definition
An exploit chain is a sequence of techniques and vulnerabilities used together so that the combined effect achieves an attacker objective—such as remote code execution, privilege escalation, or data theft—that any single step alone might not accomplish.
Why exploit chains matter
Vulnerability management often ranks issues one CVE at a time. Attackers rarely stop at one bug. An exploit chain combines multiple weaknesses into a single path to a goal: mailbox access, domain admin, ransomware deployment, or cloud tenant takeover.
A “medium” finding that only bypasses a secondary check can become critical when it unlocks a second bug that needs authenticity. Chains explain why defense in depth works—and why a single missed link still matters.
How exploit chains are built
Establish initial access
Phishing, exposed services, stolen credentials, or a public RCE provide the first foothold.
Gain code or session control
Web shells, token theft, or unsafe deserialization convert access into executable influence.
Escalate privileges
Local privilege bugs, misconfigured sudo, or over-privileged cloud roles expand control.
Move laterally
Trusted trust relationships, shared credentials, and flat networks extend reach.
Achieve objectives
Exfiltration, destructive actions, persistence, or fraud complete the mission.
Adapt if a link fails
Skilled attackers substitute alternate techniques when one control blocks a preferred step.
Characteristics of dangerous chains
Complementary bugs
One issue provides auth context; another provides memory corruption or file write.
Low noise early steps
Looks like normal browsing or business email until later stages trigger alarms.
Environment-specific glue
Misconfigurations and identity sprawl connect CVEs that seem unrelated on paper.
Rapid commoditization
Once published, chains are packaged into kits and scanned internet-wide.
Scoring vs chaining reality
| View | Limitation if used alone |
|---|---|
| Single CVE CVSS | Misses combinations and business reachability |
| KEV / known exploited | Essential signal, still needs environment context |
| Attack path analysis | Requires asset, identity, and exposure data quality |
| Detection-only strategy | May see the chain too late after impact begins |
Breaking chains
- Patch and prioritize vulnerabilities that enable authentication bypass, RCE, and privilege escalation.
- Require MFA and reduce standing privileges so stolen sessions cannot finish the chain.
- Segment networks and cloud accounts to stop lateral movement between links.
- Fix 'minor' bugs that remove safety checks attackers need for a later critical step.
- Detect intermediate behaviors: unusual parent/child processes, new persistence, abnormal admin API use.
- Threat-model important assets as paths, not isolated findings lists.
- Tabletop the failure of each control to see which alternate chain remains open.
- Track CISA KEV and vendor advisories for vulnerabilities commonly chained in the wild.
The practical takeaway
An exploit chain is the attacker’s multi-step recipe. Risk lives in the path, not only in the highest single CVSS number.
Defend by removing links, delaying progression, and detecting mid-chain activity. If you only patch the final spectacular bug while leaving the on-ramp open, attackers will keep driving through.
Related security terms
Privilege Escalation
A frequent middle or final link that turns limited access into administrative control.
Remote Code Execution (RCE)
A high-impact outcome that many exploit chains are designed to reach.
Zero-Day Exploit
Sometimes one link in a chain, combined with known bugs for full compromise.
Man-in-the-Middle (MITM)
A network position that can enable or amplify multi-step exploitation.
Frequently asked questions
What is an exploit chain in simple terms?
An exploit chain is a multi-step attack recipe. Attackers string together several weaknesses—like a phishing click, a buggy app, and a privilege bug—so the whole path succeeds even if each piece looks medium risk alone.
How is an exploit chain different from a kill chain?
A kill chain is a high-level model of attack stages. An exploit chain is a concrete technical sequence of bugs and techniques used in a specific intrusion.
Why do chains matter for patch priority?
A medium CVE that enables authentication bypass can become critical when chained with a local privilege escalation. Prioritize based on reachable combinations, not only isolated scores.
Do exploit chains always need zero-days?
No. Many successful chains use only known vulnerabilities, misconfigurations, and social engineering.
How do defenders break exploit chains?
Remove links: patch, harden configs, require MFA, segment networks, reduce privileges, and detect intermediate behaviors before the final objective.
What is an example exploit chain?
Steal a session via XSS, use that session to upload a file, abuse a path traversal to place a webshell, then escalate on the host—with each step enabling the next.
Are CVSS scores enough to rank chained risk?
CVSS helps compare individual vulnerabilities, but chaining, exposure, and business context determine real-world urgency.
References
Explore authoritative guidance and frameworks related to exploit chain.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.