CISA added CVE-2025-62593 (CVSS 9.4) affecting Ray, an open-source Python framework for scaling AI/ML workloads, to its Known Exploited Vulnerabilities (KEV) catalog on August 17, 2026. The flaw enables unauthenticated remote code execution via DNS rebinding through standard web browsers (Firefox, Safari), affecting Ray versions before 2.52.0. Federal civilian executive branch agencies must remediate by August 20, 2026; private organizations are urged to follow suit.
Ray sits at the core of modern ML pipelines used by Amazon, Apple, OpenAI, and countless enterprises to distribute Python workloads across GPU/CPU clusters. The critical issue is that Ray clusters often hold proprietary models, training data, and cloud credentials — making them prime targets. Unlike traditional ML framework vulnerabilities that require direct network access, this flaw works through browser-based attacks, dramatically lowering the bar for opportunistic attackers.
Exploitation is already occurring in the wild. A BitSight report from March 2026 documented that the RondoDox DDoS botnet incorporated CVE-2025-62593 two days before public disclosure. Separately, Oligo Security reported a campaign called ShadowRay 2.0 that hijacks unpatched Ray clusters to mine cryptocurrency, targeting internet-exposed instances across data centers.
For infrastructure teams: Ray is a critical dependency in AI pipelines. Immediately audit all Ray deployments across developer workstations, CI/CD systems, container images, and cloud clusters. Upgrade to Ray 2.52.0 immediately; verify lock files and base images don't retain vulnerable versions. If immediate patching is impossible, restrict Ray API/dashboard access through authenticated proxies, VPNs, or network segmentation.