CVE-2025-62593: CISA Confirms Active Attacks on Critical Ray AI Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-62593, a critical remote code execution flaw in the Ray AI framework, to its Known Exploited Vulnerabilities catalog on August 17, 2026, after confirming active exploitation, and mandated federal agencies patch or disable affected systems by August 20. The flaw, with a CVSS score of 9.4, affects all Ray versions prior to 2.52.0 and allows attackers to execute arbitrary code via a DNS rebinding attack that bypasses Ray's User-Agent check, impacting companies like Amazon, Apple, and OpenAI that rely on Ray for AI workloads.

A federal deadline has come and gone for one of the more unusual vulnerabilities disclosed this year, and the story behind it is still unfolding. CVE-2025-62593, a critical flaw in the widely used Ray framework, is not just another entry on a patch list. Evidence gathered by researchers shows attackers were probing for it before the vulnerability was even formally published, a detail that has security teams rethinking how they measure risk. The Cybersecurity and Infrastructure Security Agency added CVE-2025-62593 https://www.kobaran.com/tag/CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, after shifting its assessment of the flaw from proof-of-concept to confirmed active exploitation. That single change carried weight: it triggered a binding federal directive requiring civilian agencies to patch or disable affected systems by August 20, a three-day turnaround that signals how seriously the government is treating the threat. What makes CVE-2025-62593 worth watching beyond the federal deadline is where it lives. Ray is not a niche tool. It is the backbone that companies including Amazon, Apple and OpenAI rely on to scale artificial intelligence and machine learning workloads, and the flaw sits in a part of the software many organizations do not think to inventory. For developers, security teams and anyone running AI infrastructure, understanding this vulnerability is quickly becoming non-optional. What Is CVE-2025-62593 CVE-2025-62593 is a critical remote code execution vulnerability affecting Ray, the open source distributed computing engine maintained by Anyscale and used to scale Python and machine learning workloads across clusters of CPUs and GPUs. The flaw carries a CVSS score of 9.4, placing it firmly in the critical range, and it affects every version of Ray prior to 2.52.0. The vulnerability is tracked under CWE-94, a code injection weakness, and also touches on CWE-352, related to cross-site request forgery. According to the National Vulnerability Database entry maintained with input from GitHub as the CVE Numbering Authority, the flaw lives inside Ray’s HTTP API endpoint handling, specifically in routes such as /api/jobs and /api/job agent/jobs/. How the Attack Works Unlike most critical server-side vulnerabilities, CVE-2025-62593 https://www.kobaran.com/tag/CVE-2025-62593 does not require an attacker to reach across the internet to a public-facing machine. Instead, it exploits the browser sitting on a developer’s own desk. Ray’s dashboard has historically relied on a single check to keep browser-based traffic away from sensitive endpoints: rejecting any request whose User-Agent header begins with the string “Mozilla.” Security researchers at Resecurity and others have pointed out the problem with that approach. The fetch specification, which governs how browsers construct outgoing requests, allows the User-Agent header to be altered under certain conditions, making the check trivial to route around. Combine that gap with a DNS rebinding attack, and the pieces fall into place. A developer running Ray locally visits a malicious webpage, or is simply served a malicious advertisement while browsing in Firefox or Safari. The malicious page tricks the browser into treating a remote, attacker-controlled server and the local Ray instance as if they share the same origin. From there, an attacker can reach Ray’s Jobs API without any credentials, submit a crafted job, and execute arbitrary code with whatever privileges the Ray process holds. No login screen ever appears, and no password is ever needed. Why Ray’s Own Design Choices Are Part of the Story Ray’s maintainers have been candid about the root cause. In a security advisory published in November 2025, the development team acknowledged what they described as a longstanding decision not to implement authentication on Ray’s most sensitive endpoints. That decision assumed Ray would always operate behind a trusted network boundary, an assumption that has now been tested and found wanting for the second time, since a related flaw exposed the same design gap previously. The practical consequence is that Ray rarely sits alone on a single laptop. It is frequently embedded inside continuous integration runners, baked into container images, and deployed across Kubernetes clusters, often without a clear inventory of where every instance lives. That makes CVE-2025-62593 as much an asset management problem as a patching problem. The Botnet That Beat the Disclosure The detail driving most of the renewed attention on CVE-2025-62593 comes from Bitsight, a security ratings firm that has been tracking a Mirai-derived botnet known as RondoDox since it emerged as a fast-growing exploitation engine. According to Bitsight’s research, RondoDox began attempting to exploit the Ray flaw on November 24, 2025, two full days before the CVE record was formally published on November 26. Bitsight’s analysts concluded that RondoDox’s operators were not waiting on the official CVE calendar at all. Instead, the botnet appears to monitor public vulnerability research, security advisories and proof-of-concept code directly, adopting new exploits as soon as usable details surface rather than waiting for a formal disclosure date. Researchers noted a similar pattern with other flaws in RondoDox’s arsenal, including one instance where a newly disclosed React-related bug was folded into the botnet’s toolkit within three days of publication. A Twist in the Exploit Itself There is an ironic wrinkle in how RondoDox actually carried out its early attempts. Bitsight’s telemetry shows the botnet’s requests set the User-Agent string to a value beginning with “Mozilla/5.0,” paired with an email address associated with the operators. That happens to be exactly the prefix Ray’s flawed guard was designed to block. Accounts differ slightly on the practical outcome of that overlap. Some researchers, including Bitsight itself, have suggested the malformed implementation may have rendered RondoDox’s specific exploit attempts ineffective against the very check they were trying to defeat, consistent with the firm’s broader observation that RondoDox has, in a number of cases, mis-implemented the exploits it rushes to adopt. Other reporting on the same dataset frames the User-Agent value as matching the exact string the guard was checking for. Either way, security researchers are unanimous that sloppy exploit code does not make the underlying flaw any less dangerous, since a corrected payload from RondoDox or any other actor would still succeed against unpatched systems. RondoDox’s Bigger Pattern CVE-2025-62593 is not an isolated case for RondoDox. Bitsight’s broader analysis of the botnet found it has chained together 174 distinct vulnerabilities, the large majority tied to formally assigned CVEs, with a smaller set based on public proof-of-concept code that never received a CVE number at all. The botnet has also been linked separately to large-scale exploitation of an unrelated maximum-severity flaw in HPE’s OneView management platform, underscoring that RondoDox operates as a broad, opportunistic scanning operation rather than one narrowly focused on AI infrastructure. Ray installations have drawn attention from more than one threat group. Researchers at Oligo Security have separately tracked a campaign dubbed ShadowRay 2.0, which specifically hunts for unpatched Ray clusters equipped with expensive NVIDIA GPUs and hijacks them to mine cryptocurrency, a reminder that a single unpatched framework can attract multiple, differently motivated attackers at once. The Federal Response and What It Means for Everyone Else CISA’s Known Exploited Vulnerabilities catalog exists to force a specific kind of urgency inside the federal government. Under Binding Operational Directive requirements, agencies must remediate listed flaws by a set deadline or stop using the affected product entirely. For CVE-2025-62593, that deadline landed just three days after the catalog listing, a notably tight window that reflects how CISA weighed the evidence of active exploitation. CISA has not published technical details of how attacks are being carried out in the wild, a standard practice for KEV listings that avoids handing defenders’ adversaries a ready-made playbook. The absence of public exploitation detail from CISA does not diminish the significance of the listing itself. Being added to the KEV catalog is, by definition, a confirmation that real-world attacks are already underway. That deadline is binding only on federal civilian agencies. Private companies, universities, and independent developers running Ray face no such mandate, even though the underlying risk is identical. Comparing the Response Timeline | Date | Event | |---|---| | November 24, 2025 | RondoDox botnet begins probing for the Ray flaw, according to Bitsight | | November 26, 2025 | CVE-2025-62593 is formally published with a CVSS score of 9.4 | | Late 2025 to early 2026 | Ray maintainers release version 2.52.0 with a fix; Bitsight and other firms continue tracking RondoDox activity | | August 17, 2026 | CISA adds CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, citing active exploitation | | August 20, 2026 | Deadline for federal civilian agencies to patch or disable affected Ray instances | What Organizations Running Ray Should Do Now Security researchers and Ray’s own maintainers point to the same starting point: identify every instance of Ray running below version 2.52.0 and update it. Because Ray frequently runs inside developer workstations, CI pipelines, container base images and Kubernetes workloads rather than as a standalone application, that inventory step is often harder than the patch itself. Practical Mitigation Steps Beyond updating to Ray 2.52.0 or later, security researchers who have examined the flaw in depth, including the team at Resecurity, recommend a layered approach given how the attack chain depends on browser access reaching a local service. Organizations are encouraged to avoid exposing Ray’s dashboard or API ports directly to systems where developers also browse the open web, to segment networks so that local AI development tools are not reachable from general-purpose workstations, and to treat any research disclosure or vendor advisory as a lagging indicator rather than an early warning, given how quickly opportunistic botnets like RondoDox have shown they can move. Why This Case Is a Warning Sign for AI Infrastructure Broadly The timeline behind CVE-2025-62593 has implications that extend past this single flaw. If a botnet operator can identify and weaponize a vulnerability before its CVE record is even published, then waiting for a formal disclosure is no longer a reliable early warning system for defenders. Bitsight’s research suggests RondoDox is increasingly reading the same public security research that defenders read, and in at least one case, reading it faster. That shift matters especially for the AI and machine learning ecosystem, where frameworks like Ray have expanded rapidly in popularity, currently drawing more than 43,500 stars on GitHub, without always receiving the same security scrutiny applied to traditional enterprise software. As more organizations build production AI pipelines on open source tooling, vulnerabilities that touch developer machines rather than hardened servers are likely to become a more common attack surface, not a less common one. Frequently Asked Questions What is Ray, and why does this vulnerability matter so much? Ray is an open source framework used to scale Python and machine learning workloads across clusters of computers. It is used by major technology companies to run AI infrastructure, so a critical flaw in Ray has the potential to expose training data, credentials and cloud resources across a wide range of organizations. Do I need to be running Ray on a public server to be at risk? No. The attack path for CVE-2025-62593 runs through a developer’s own browser while Ray is running locally or inside internal infrastructure, not through a traditional internet-facing server. Is there a patch available? Yes. Ray version 2.52.0 addresses the vulnerability. Any installation on an earlier version remains exposed. Has this vulnerability actually been used in real attacks? Yes. CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 17, 2026, after determining there was evidence of active exploitation, including activity tied to the RondoDox botnet.