CISA puts Ray on the KEV list, and the exploit path runs through your developers' browsers

CISA added CVE-2025-62593, a code injection flaw in the Ray distributed computing framework, to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation ^[1][2]. Federal civilian agencies have until August 20, 2026 to fix or mitigate it ^[10], and the detail that should change how everyone else scopes this is that the exploitation path does not require your Ray cluster to be reachable from the internet.

Ray is the open-source, Python-native framework AI and ML teams use to scale workloads; the GitHub project has more than 43,500 stars and over 7,900 forks ^[12]. The vulnerability carries a CVSS score of 9.4 and can produce remote code execution through browsers including Firefox and Safari by means of a DNS rebinding attack ^[3]. The root cause is not subtle. In an advisory published in November 2025, Ray's maintainers wrote that "the longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like the /api/jobs & /api/job_agent/jobs/ has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray" ^[15]. The specific defect is insufficient control against browser-based attacks, in scenarios where the User-Agent header can be modified ^[4]. The words "once again" are the maintainers', and they carry the operational implication: patching this CVE does not add authentication to those endpoints ^[15].

According to the maintainers, a developer running Ray who inadvertently visits a malicious website or is served a malicious advertisement can end up executing arbitrary shell code on their machine ^[5], and the defect primarily affects development and testing environments ^[6]. They also said the attack can be extended to network-adjacent Ray instances by using the browser as a confused deputy intermediary to reach clusters running inside a private corporate network ^[11]. Segmentation is therefore a partial control at best. The browser is already inside the boundary you were counting on.

The fix is Ray 2.52.0 ^[7]. Ray credited Oligo security researcher Avi Lumelsky with the fetch bypass and Jonathan Leitschuh with the DNS rebinding attack ^[16].

CISA has not shared details of how the flaw is being exploited in the wild ^[8]. What is on the record elsewhere: BitSight reported in March 2026 that the operators of the RondoDox DDoS botnet added the vulnerability to their arsenal two days before it was publicly disclosed on November 26, 2025, because a proof-of-concept exploit was available ^[9]. Oligo separately reports that unpatched Ray instances have been attacked in a campaign it calls ShadowRay 2.0, which turns infected clusters with NVIDIA GPUs into a self-replicating cryptocurrency mining botnet ^[17]. The KEV listing lands roughly nine months after public disclosure ^[18].

Binding Operational Directive 26-04 requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control post-exploitation, and to check whether threat actors compromised the system before the patch was applied ^[13]. CISA encourages all organizations to adopt the same risk-based approach ^[14]. That second requirement is the one worth copying: with RondoDox holding a pre-disclosure head start ^[9] and mining campaigns already running against unpatched clusters ^[17], "we patched" does not establish that a cluster was not already earning money for somebody else.

Watch for whether CISA or Oligo publish indicators for the exploited variant ^[8][17], and whether the Ray project revisits authentication on /api/jobs and /api/job_agent/jobs/ rather than shipping another browser-specific control ^[15]. Meanwhile, the inventory question is the immediate one: which developer laptops and unreviewed test clusters in your estate are running Ray below 2.52.0 ^[7].