CVSS scored these two Palo Alto CVEs as manageable. Chained, they gave attackers root access to 13,000 devices.

During Operation Lunar Peek in November 2024, attackers gained unauthenticated remote admin access — and eventual root — across more than 13,000 exposed Palo Alto Networks management interfaces. Palo Alto Networks scored CVE-2024-0012 at 9.3 and CVE-2024-9474 at 6.9 under CVSS v4.0. NVD scored the same pair 9.8 and 7.2 under CVSS v3.1. Two scoring systems. Two different answers for the same vulnerabilities. The 6.9 fell below patch thresholds. Admin access appeared required. The 9.3 sat queued for maintenance. Segmentation would hold.

"Adversaries circumvent [severity ratings] by chaining vulnerabilities together," Adam Meyers, SVP of Counter Adversary Operations at CrowdStrike, told VentureBeat in an exclusive interview. On the triage logic that missed the chain: "They just had amnesia from 30 seconds before."

Both CVEs sit on the CISA Known Exploited Vulnerabilities catalog. Neither score flagged the kill chain. The triage logic that consumed those scores treated each CVE as an isolated event, and so did the SLA dashboards and the board reports those dashboards feed.

CVSS did exactly what it was designed to do. Score one vulnerability at a time. The problem is that adversaries do not attack one vulnerability at a time.

"CVSS base scores are theoretical measures of severity that ignore real-world context," wrote Peter Chronis, former CISO of Paramount. By moving beyond CVSS-first prioritization, Chronis reported reducing actionable critical and high-risk vulnerabilities by 90%. Chris Gibson, executive director of FIRST, has been equally direct: using CVSS base scores alone for prioritization is "the least apt and accurate" method.

Five triage failure classes CVSS was never designed to catch

In 2025, 48,185 CVEs were disclosed, a 20.6% year-over-year increase. The infrastructure behind the scores is buckling under that weight.

1. Chained CVEs that look safe until they aren't

The Palo Alto pair is the textbook. CVE-2024-0012 bypassed authentication. CVE-2024-9474 escalated privileges. Scored separately, the escalation flaw filtered below most enterprise patch thresholds because admin access appeared required. The authentication bypass upstream eliminated that prerequisite entirely.

2. Nation-state adversaries who weaponize patches within days

CrowdStrike documented a 42% increase in vulnerabilities exploited as zero-days. Average breakout time: 29 minutes. Fastest: 27 seconds. China-nexus adversaries weaponized newly patched vulnerabilities within two to six days of disclosure.

3. Stockpiled CVEs that nation-state actors hold for years

Salt Typhoon accessed senior U.S. political figures' communications by chaining CVEs from 2023 that remained unpatched for over a year. CVSS does not degrade priority based on how long a CVE has gone unpatched. No board metric tracks aging KEV exposure.

4. Identity gaps that never enter the scoring system

A 2023 social engineering attack caused $100 million in losses without a single CVE. The vulnerability was a human process gap. Agentic AI systems now carry their own credentials, operating outside traditional vulnerability management governance.

5. AI-accelerated discovery that breaks pipeline capacity

AI models can now discover vulnerabilities at a fraction of the cost. If AI drives a 10x volume increase, pipelines built for 48,000 CVEs will collapse. Project QuiltWorks was launched by industry leaders to address this AI-generated vulnerability volume.

Security director action plan

• Run a chain-dependency audit on every KEV CVE. Flag any pair chaining authentication bypass to privilege escalation as critical.
• Compress KEV-to-patch SLAs to 72 hours for internet-facing systems.
• Build a monthly KEV aging report for the board, tracking days since disclosure and patch availability.
• Add identity-surface controls to the vulnerability reporting pipeline.
• Stress-test vulnerability management pipelines against AI-driven volume increases.