CySA+ labs
Every hands-on lab that maps to the CompTIA CySA+ (CS0-003) certification. This is the full lab package for that certification.
Certification: CompTIA › CySA+ CS0-003 clear · browse all certifications
38 labs
Beginner
AI Platform Patch Triage & Remediation: CVE-2025-3248
Triage a Critical, CISA-KEV-listed Langflow unauthenticated code-injection RCE (CVE-2025-3248) on /api/v1/validate/code: confirm the version, score it with CVSS, identify CWE-306, judge the pre-auth exposure, upgrade and verify, and recognize that the endpoint should require auth.
Beginner
Analytics Server Patch Triage & Remediation: CVE-2023-38646
Triage a Critical, CISA-KEV-listed Metabase unauthenticated H2 JDBC RCE (CVE-2023-38646): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Appliance Patch Triage & Remediation: CVE-2026-10520
Triage a maximum-severity, CISA-KEV-listed Ivanti Sentry unauthenticated OS command injection (CVE-2026-10520) that gives root RCE: confirm the build, score it with CVSS, identify CWE-78, judge the pre-auth appliance exposure, upgrade and verify, and recognize that the management interface should be restricted.
Beginner
Application Server Patch Triage & Remediation: CVE-2025-24813
Triage a maximum-severity, CISA-KEV-listed Apache Tomcat partial-PUT path-equivalence finding (CVE-2025-24813) that can reach RCE: confirm the version and the enabling config, score it with CVSS, identify CWE-44 + CWE-502, judge exposure, upgrade and verify, and recognize the hardening that breaks the chain.
Beginner
Application Server Patch Triage & Remediation: CVE-2026-48282
Triage a maximum-severity, CISA-KEV-listed Adobe ColdFusion path-traversal-to-RCE finding (CVE-2026-48282): confirm the version, score it with CVSS, identify CWE-22, judge the pre-auth exposure, apply the APSB26-68 update and verify, and recognize the lockdown hardening.
Beginner
Automation Platform Patch Triage & Remediation: CVE-2025-68613
Triage a Critical, CISA-KEV-listed n8n workflow-expression RCE (CVE-2025-68613) where a low-trust editor escapes the expression sandbox to run code on the server: confirm the version, score it with CVSS and see why it is 9.9 despite needing a login (scope changed), identify CWE-913, judge the insider threat model, upgrade and verify.
Beginner
BI Platform Patch Triage & Remediation: CVE-2026-72898
Triage a maximum-severity, CISA-KEV-listed Metabase unauthenticated SQL injection (CVE-2026-72898) on /reset_password that yields admin: confirm the version, score it with CVSS, identify CWE-89, judge the pre-auth exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
CI/CD Patch Triage & Remediation: CVE-2024-23897
Triage a Critical, CISA-KEV-listed Jenkins CLI arbitrary-file-read finding (CVE-2024-23897): confirm the version, score it with CVSS and see why a file read is 9.8 (unauthenticated, reads controller secrets), identify CWE-27, judge the pre-auth exposure, upgrade and verify, and rotate exposed secrets.
Beginner
DBA Tool Patch Triage & Remediation: CVE-2024-2044
Triage a Critical pgAdmin 4 session path-traversal-to-pickle-RCE finding (CVE-2024-2044): confirm the version, score it with CVSS, identify CWE-31, judge the authenticated low-trust exposure, upgrade and verify, and recognize that exploited instances need credential rotation.
Beginner
Device Patch Triage & Remediation: CVE-2026-2329
Triage a Critical unauthenticated-RCE finding (CVE-2026-2329) across a fleet of Grandstream GXP16xx IP phones: confirm the firmware, score it with CVSS, judge network exposure, push the fixed firmware and verify the fleet is clean.
Beginner
Firewall Patch Triage & Remediation: CVE-2024-3400
Triage a maximum-severity, CISA-KEV-listed PAN-OS GlobalProtect unauthenticated command injection (CVE-2024-3400) that gives root RCE on the perimeter firewall: confirm the version and GlobalProtect config, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify, and assume breach given active exploitation.
Beginner
Framework Patch Triage & Remediation: CVE-2025-29927
Triage a Critical Next.js middleware authorization bypass (CVE-2025-29927): confirm the version, score it with CVSS and see why it is 9.1 despite A:N, identify CWE-285, judge the unauthenticated exposure, upgrade and verify, and know the edge workaround (strip the x-middleware-subrequest header).
Beginner
Framework Patch Triage & Remediation: CVE-2025-55182
Triage a maximum-severity, CISA-KEV-listed React Server Components deserialization RCE (CVE-2025-55182): confirm the package version, score it with CVSS and see why it is 10.0, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Geospatial Server Patch Triage & Remediation: CVE-2024-36401
Triage a Critical, CISA-KEV-listed GeoServer unauthenticated OGC expression RCE (CVE-2024-36401): confirm the version, score it with CVSS, identify CWE-94, judge the pre-auth exposure, upgrade and verify.
Beginner
Graph Database Patch Triage & Remediation: CVE-2024-27348
Triage a Critical, CISA-KEV-listed Apache HugeGraph-Server unauthenticated Gremlin RCE (CVE-2024-27348): confirm the version, score it with CVSS, identify CWE-77, judge the pre-auth exposure, upgrade and verify.
Beginner
Healthcare Integration Engine Patch Triage & Remediation: CVE-2023-43208
Triage a Critical, CISA-KEV-listed NextGen Healthcare Mirth Connect unauthenticated deserialization RCE (CVE-2023-43208): confirm the version, score it with CVSS, identify CWE-502, judge the pre-auth exposure, upgrade and verify.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-31431
Triage a High-severity Linux kernel local-privilege-escalation finding (CVE-2026-31431) on a shared multi-user host: confirm the running kernel, score it with CVSS, judge local exposure, install the branch's fixed release, reboot, and verify the host is clean.
Beginner
Kernel Patch Triage & Remediation: CVE-2026-43284 & CVE-2026-43500
Triage two Linux kernel local-privilege-escalation findings (CVE-2026-43284 and CVE-2026-43500) in one running kernel on a shared host: confirm the kernel, score both with CVSS, judge exposure, then apply the single update that fixes both and verify.
Beginner
LMS Patch Triage & Remediation: CVE-2023-34960
Triage a Critical Chamilo LMS unauthenticated OS command injection (CVE-2023-34960): confirm the version, score it with CVSS, identify CWE-78, judge the pre-auth exposure, upgrade and verify.
Beginner
Print Management Server Patch Triage & Remediation: CVE-2023-27350
Triage a Critical, CISA-KEV-listed PaperCut NG/MF unauthenticated admin bypass to RCE (CVE-2023-27350): confirm the version, score it with CVSS, identify CWE-284, judge the pre-auth exposure, upgrade and verify.
Beginner
Privilege Escalation Patch Triage & Remediation: CVE-2025-32463
Triage a Critical, CISA-KEV-listed sudo --chroot local privilege escalation (CVE-2025-32463) that gives any local user root: confirm the version, score it with CVSS and see why a local bug still scores 9.3 (scope-changed full root), identify CWE-829, judge the shared-host exposure, upgrade and verify.
Beginner
Server Patch Triage & Remediation: CVE-2026-42167
Triage a High-severity ProFTPD SQL-injection finding (CVE-2026-42167) on an internet-facing FTP server: confirm the version, score it with CVSS, understand the conditions it needs, upgrade to the fixed release and verify.
Beginner
Vulnerability Triage & Remediation: CVE-2026-29058
Work a real Critical finding end to end as a Tier-1 analyst: confirm WWBN AVideo CVE-2026-29058 on the host, score it with CVSS, hunt the logs for probe attempts, apply a compensating control, patch to the fixed version, and verify the host is clean.
Beginner
Web App Authentication: Find, Confirm & Fix (Basic)
Hands-on with Authentication Weakness (brute force) (CWE-307) in Acme Accounts's login feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Broken Access Control: Find, Confirm & Fix (Basic)
Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Command Injection: Find, Confirm & Fix (Basic)
Hands-on with Command Injection (CWE-78) in Acme Ops Console's host-diagnostics (ping) feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App CSRF: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Request Forgery (CSRF) (CWE-352) in Acme Bank's change-password / money-transfer actions. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Inclusion: Find, Confirm & Fix (Basic)
Hands-on with File Inclusion (LFI/RFI) (CWE-98) in Acme CMS's page renderer (?page=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Upload: Find, Confirm & Fix (Basic)
Hands-on with Unrestricted File Upload (CWE-434) in Acme Portal's avatar/document upload feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SQL Injection: Find, Confirm & Fix (Basic)
Hands-on with SQL Injection (CWE-89) in Acme Store's login / product-search feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SSRF: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.
Beginner
Web App SSTI: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Template Injection (SSTI) (CWE-1336) in Acme Mailer's greeting/personalization feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XSS: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Scripting (XSS) (CWE-79) in Acme Community's comment feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XXE: Find, Confirm & Fix (Basic)
Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web Application Patch Triage & Remediation: CVE-2025-31131
Triage a High-severity YesWiki path-traversal file-read finding (CVE-2025-31131): confirm the version, score it with CVSS and see why a read-only bug is still High (unauthenticated, scope-changed), identify CWE-22, judge exposure, upgrade and verify, and recognize that exposed secrets must be rotated.
Beginner
Web Server Patch Triage & Remediation: CVE-2026-42945
Triage a High-severity NGINX heap-overflow finding (CVE-2026-42945) on an internet-facing reverse proxy: confirm the version, score it with CVSS and see why AC:H keeps it below Critical, judge exposure, upgrade to the fixed release and verify.
Beginner
Webmail Patch Triage & Remediation: CVE-2025-49113
Triage a Critical, CISA-KEV-listed Roundcube Webmail PHP object-injection RCE (CVE-2025-49113) reachable by any mailbox user: confirm the version, score it with CVSS, identify CWE-502, judge the low-trust authenticated exposure, upgrade and verify.
Beginner
WordPress Plugin Patch Triage & Remediation: CVE-2026-1357
Triage a Critical WPvivid Backup & Migration arbitrary-file-upload finding (CVE-2026-1357) on an internet-facing WordPress site: confirm the plugin version, score it with CVSS and see why it is Critical, identify CWE-434, judge exposure, update to the fixed release and verify.