CISA Orders Emergency Patch as Ray AI Framework Flaw Faces Active Exploitation

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. Ray is an open-source, Python-native distributed computing framework designed to scale artificial intelligence and machine learning workloads. As of writing, the GitHub project has more than 43,500 stars and has been forked over 7,900 times. The vulnerability in question relates to CVE-2025-62593 (CVSS score: 9.4), which can result in remote code execution via web browsers like Mozilla Firefox and Apple Safari by means of a DNS rebinding attack. "Due to the longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like the /api/jobs & /api/job_agent/jobs/ has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray," according to an advisory shared by Ray maintainers in November 2025. "This time in a development context via the browsers Firefox and Safari." The issue, at its core, stems from insufficient controls against browser-based attacks, specifically scenarios where the User-Agent header can be modified. "Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement," the project maintainers added. It's worth noting that the defect primarily impacts developers running development/testing environments with Ray. Should a targeted victim fall prey to a phishing attack, or be served a malicious ad, it can lead to the execution of arbitrary shell code on their machine. The project maintainers also noted that the attack can also be extended to attack network-adjacent instances of Ray by leveraging the browser as a confused deputy intermediary to target Ray instances running inside a private corporate network. The issue has been addressed in version 2.52.0 of the Python package. Ray has credited Oligo security researcher Avi Lumelsky with discovering the fetch bypass and Jonathan Leitschuh for coming up with the DNS rebinding attack. CISA has not shared any details of how the vulnerability is being exploited in the wild. However, a BitSight report from March 2026 revealed that the threat actors behind the RondoDox DDoS botnet had incorporated the vulnerability into their arsenal two days before it was publicly disclosed on November 26, 2025, because of the availability of a proof-of-concept (PoC) exploit. According to Oligo, unpatched Ray instances have also been at the receiving end of cyber attacks that aim to turn infected clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet as part of a campaign dubbed ShadowRay 2.0. In light of active exploitation of CVE-2025-62593, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply necessary fixes and mitigations by August 20, 2026.

CISA orders a three-day patch after a flaw in the Ray AI framework comes under active attack

A code-injection bug in Ray, the open-source engine behind countless AI workloads, is being exploited in the wild. US federal agencies have until 20 August to fix it, and private operators should not wait. America's cyber-defence agency has added a single vulnerability in Ray, the open-source framework that powers a large slice of the world's AI training and inference, to its Known Exploited Vulnerabilities catalogue, confirming that the flaw is being used in real-world attacks. The Cybersecurity and Infrastructure Security Agency made the move on 17 August, giving federal agencies until 20 August to patch the software or stop running it, one of the tightest windows it issues. The bug, tracked as CVE-2025-62593, is a code-injection weakness that can hand an attacker remote code execution on a vulnerable Ray deployment. In plain terms, someone who has never logged in could get a target's machine to run commands of their choosing. CISA does not publish exploitation details, and neither will we; the point of a KEV listing is not how the attack works but that it is already working. The catalogue is the same mechanism through which the agency, itself recently caught without its own incident-response playbook, presses federal networks to close actively exploited holes. Ray is maintained by Anyscale and sits at the heart of modern machine-learning pipelines, distributing Python workloads across clusters of CPUs and GPUs. That ubiquity is exactly what makes the vulnerability serious: the software rarely runs on a single laptop, but across pools of expensive compute holding proprietary models, training data, and cloud credentials. It is the kind of system that tends to be spun up fast by data-science teams and then quietly forgotten by whoever is meant to be securing it. Anyscale has fixed the issue in Ray version 2.52.0, so the operators still on earlier releases are the ones exposed. According to CISA's entry, the flaw is unusual in that it can be reached through an ordinary web browser, including Firefox and Safari, rather than requiring direct network access to a Ray service. That lowers the bar for exploitation considerably, and is part of why the agency moved quickly. Ray's problem is also the open-source ecosystem's problem. Widely deployed infrastructure written and maintained by comparatively small teams becomes a single point of failure for everyone downstream, a dynamic laid bare by the Log4j crisis and its long tail of open-source funding questions. AI has only raised the stakes, because the compute now sitting behind these frameworks is among the most valuable on any network. Ray clusters have been a target before. Researchers at Oligo Security documented a campaign they called ShadowRay, tied to a separate and older Ray weakness, in which more than 230,000 internet-exposed servers were scanned and compromised systems were mined for cryptocurrency, credentials, and whole repositories of source code and models. That earlier flaw is not the one CISA listed this week, but it is a preview of what exposed Ray infrastructure attracts, from cryptojacking that quietly hijacks hardware to outright data theft. CISA lists the vulnerability's known use in ransomware campaigns as "unknown", so there is no confirmed extortion angle at this stage; the immediate risk is unauthorised code execution and everything that follows from it. Even so, the pattern is a familiar one: a critical flaw, a patch available, exploitation confirmed, and a shrinking window before opportunistic attackers pile in, much as they did with an actively exploited Java zero-day years earlier. For federal agencies the deadline is fixed at 20 August under CISA's binding-directive framework, the catalogue first established by Binding Operational Directive 22-01 and now governed by the risk-based BOD 26-04. Private-sector operators face no legal clock, but the government deadline is a reasonable proxy for how urgently everyone else should treat it. The security-desk advice is the calmer version of the same order: find any Ray deployment on your network, confirm whether it is reachable from outside, restrict access to it, and move to 2.52.0 without waiting to learn whether you are already on someone's list.