#Cvss Limitations

CVSS scored these two Palo Alto CVEs as manageable. Chained, they gave attackers root access to 13,000 devices.

Two individually moderate Palo Alto vulnerabilities, when chained together, compromised 13,000 devices because CVSS scoring treats each vulnerability in isolation rather than accounting for real-world attack chains—a critical gap as adversaries now exploit vulnerability combinations, weaponize patches within days, and exploit aged unpatched CVEs while identity and AI credential management remain outside traditional vulnerability scoring systems. This breakdown in risk prioritization threatens IT organizations that rely on CVSS-first triage logic, with 48,000+ CVEs disclosed in 2025 and projections of 70,000+ in 2026, overwhelming current assessment infrastructure. IT leaders must recognize that CVSS base scores alone are insufficient for modern threat environments and that vulnerability management governance gaps—including identity verification processes and AI credential controls—represent exploitable security blind spots equivalent to unpatched software CVEs.