The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-62593, a critical remote code execution vulnerability in the Ray AI compute engine, to its Known Exploited Vulnerabilities catalog on Aug. 17, 2026. Federal Civilian Executive Branch agencies have until Aug. 20—three days from the catalog listing—to apply a fix under Binding Operational Directive 22-01, which mandates remediation of cataloged flaws within CISA-set deadlines.
The vulnerability carries a CVSS score of 9.4 out of 10, placing it in the critical tier. CVSS—the Common Vulnerability Scoring System—is the industry-standard severity scale running from zero to 10; scores above nine represent the highest-risk flaws. Ray versions before 2.52.0 are affected. The fix is Ray 2.52.0, which addresses the insufficient browser-based attack guard at the root of the problem.
The flaw lives in how older Ray builds protected their dashboard and API interface from browser-originated requests. The defense mechanism checked whether the HTTP User-Agent header—a string browsers send to identify themselves—started with the word "Mozilla." Browsers can freely modify that header. The fetch specification, which governs how browsers make web requests, explicitly allows User-Agent header modification, making the check trivially bypassable.
An attacker chains that weak check with a DNS rebinding attack to achieve code execution. DNS rebinding abuses the browser's domain resolution process to make a malicious remote site appear local to the victim's machine, bypassing same-origin protections that normally prevent cross-site requests. Combined with the breakable User-Agent check, the attack requires only that a developer running Ray visit a malicious website or load a malicious advertisement—a technique known as malvertising—while their Ray instance is active. No additional user interaction is required after that page load.
The vulnerability affects Firefox and Safari specifically. Chrome is not listed as an affected browser in the advisory. Developers running Ray on machines where either of those browsers is open represent the attack surface.
Security firm Aviatrix published an analysis of observed exploitation describing a full attack chain that went well beyond initial code injection. According to Aviatrix's analysis, attackers who exploited CVE-2025-62593 used the initial Ray foothold to escalate privileges on the compromised system, move laterally across the network, establish command-and-control channels for persistent access, exfiltrate sensitive data and ultimately disrupt operations. That sequence—initial access, privilege escalation, lateral movement, data theft—mirrors the pattern seen in financially motivated ransomware campaigns and nation-state intrusions.
Ray is an open-source AI compute framework used to distribute machine learning workloads across clusters of machines. Organizations running large-scale model training, inference pipelines or reinforcement learning jobs commonly run Ray on developer workstations and internal servers. A compromised Ray dashboard gives an attacker a direct route into the compute environment where model weights, training data and API credentials typically reside.
CISA's Known Exploited Vulnerabilities catalog, established under BOD 22-01, functions as the government's authoritative list of flaws confirmed to be actively exploited in the wild. Addition to the KEV catalog means CISA has evidence the vulnerability is being used in real attacks at the time of listing. The catalog currently tracks hundreds of vulnerabilities across software vendors; Ray's inclusion puts it alongside enterprise networking gear, operating systems and cloud management tools as a confirmed active threat.
The Aug. 20 remediation deadline applies specifically to FCEB agencies, which cover the broad civilian federal government footprint—departments such as Treasury, Commerce and Energy along with independent agencies. The directive does not carry legal enforcement weight over private-sector organizations, but CISA recommends that private companies review the KEV catalog and remediate listed vulnerabilities in their own infrastructure. For enterprises running Ray in AI development pipelines, that recommendation carries weight given the Aviatrix-documented exploitation chain.
The patch path is straightforward: upgrade to Ray 2.52.0. Organizations that cannot immediately upgrade should isolate Ray dashboard and API interfaces from general browser access, restrict network-level access to the Ray dashboard port and audit logs for anomalous DNS resolution patterns that could indicate rebinding attempts. CISA's advisory does not specify whether any federal systems were compromised through this vulnerability prior to the catalog listing.
