Threat · curated 18 Aug 2026
CISA Adds One Known Exploited Vulnerability to Catalog
First reported cisa.gov
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
CVE-2025-62593 is an actively exploited critical RCE in Ray, a widely deployed framework for scaling AI and machine learning workloads, exposing AI/ML infrastructure to full compromise unless organizations patch immediately.
CISA added CVE-2025-62593 (CVSS 9.4), a critical flaw in the open-source Ray AI/ML distributed computing framework, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The vulnerability can enable remote code execution via web browsers such as Firefox and Safari, and Ray's GitHub project has more than 43,500 stars and 7,900 forks.
Summary
On August 17, 2026, CISA added CVE-2025-62593, a critical (CVSS 9.4) flaw in the open-source Ray distributed computing framework, to its Known Exploited Vulnerabilities catalog after determining it is being actively exploited. Federal Civilian Executive Branch agencies were directed to remediate by August 20, 2026.[0][9]
The vulnerability allows browser-based remote code execution against developers running Ray. Rooted in Ray's longstanding lack of authentication on critical endpoints and insufficient defenses against browser-based requests, it can be triggered when a developer visits a malicious website or is served a malicious advertisement, leveraging a DNS rebinding attack via Firefox or Safari. It was fixed in Ray version 2.52.0.[0]
CISA did not detail how the flaw is being exploited in the wild, but prior reporting ties Ray exploitation to opportunistic threat activity: BitSight observed the RondoDox DDoS botnet weaponize the flaw shortly before public disclosure, and Oligo tracked cryptomining exploitation of unpatched Ray clusters under the name ShadowRay 2.0.[0]
Attack chain
- Lure / Initial Access: A developer running a Ray development or testing environment inadvertently visits a malicious website or is served a malicious advertisement, exposing their browser to attacker-controlled content.[0]
- Exploitation: The attacker uses a DNS rebinding attack combined with a fetch bypass so the victim's browser (Firefox or Safari) issues requests to unauthenticated Ray endpoints such as /api/jobs and /api/job_agent/jobs/, resulting in execution of arbitrary shell code on the victim machine.[0]
- Lateral movement: The attack can be extended to network-adjacent Ray instances by using the browser as a confused-deputy intermediary to reach Ray instances running inside a private corporate network.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-11-24 (approx.) | The RondoDox DDoS botnet incorporated the vulnerability roughly two days before public disclosure, per a March 2026 BitSight report.[0] |
| 2025-11-26 | CVE-2025-62593 publicly disclosed, with an advisory shared by Ray maintainers in November 2025 and a proof-of-concept exploit available.[0] |
| 2026-08-17 | CISA added CVE-2025-62593 to the Known Exploited Vulnerabilities catalog citing active exploitation.[0][9] |
| 2026-08-20 | Remediation deadline set for Federal Civilian Executive Branch agencies.[0] |
How it works
The Ray Development team has not implemented authentication on critical endpoints such as /api/jobs and /api/job_agent/jobs/. Combined with insufficient controls against browser-based attacks — specifically scenarios where the User-Agent header can be modified — this allows attackers to execute arbitrary code against Ray.[0]
Exploitation relies on a fetch bypass paired with a DNS rebinding attack against the victim's browser (Firefox or Safari). A developer who visits a malicious website or is served a malicious ad can have arbitrary shell code executed on their machine, and the browser can be used as a confused-deputy intermediary to reach network-adjacent Ray instances inside a private network.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Ray (open-source Python distributed computing framework) | Versions prior to 2.52.0 running development/testing environments | Fixed in version 2.52.0 of the Python package[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2025-62593 | The actively exploited Ray remote code execution vulnerability (CVSS 9.4) added to CISA's KEV catalog.[0][9] |
Key takeaways
- CVE-2025-62593 was weaponized rapidly — the RondoDox botnet reportedly integrated it before public disclosure — underscoring the risk that unauthenticated Ray endpoints pose once a PoC is available.[0]
- Even development/testing tooling like Ray can become a remote-code-execution vector through browser-based DNS rebinding, so internal developer environments should be treated as attack surface and patched to 2.52.0 promptly.[0]
Defensive actions
- Upgrade Ray to version 2.52.0 or later.: The vulnerability is fixed in Ray 2.52.0; CISA directed FCEB agencies to apply fixes and mitigations by August 20, 2026.[0]
- Restrict and avoid exposing Ray development/testing environments to untrusted browser traffic and networks.: The flaw primarily impacts developers running Ray in development/testing contexts and is triggered when a developer visits a malicious website or is served a malicious ad, with the browser usable to reach network-adjacent Ray instances.[0]