CVE-2025-62593: Ray Distributed Computing Framework RCE Exploited in the Wild; CISA Adds to KEV with Three-Day Patch Deadline

CISA added Ray framework CVE-2025-62593 to KEV on 8/17, CVSS 9.4; DNS rebinding plus Firefox/Safari yields RCE on developer hosts.

CISA added CVE-2025-62593 in the open-source AI/ML distributed computing framework Ray to the Known Exploited Vulnerabilities (KEV) catalog on August 17, 2026, giving federal civilian agencies a three-day patch window (deadline August 20). CVSS v4 9.4 (Critical). Combined with a browser User-Agent check flaw and DNS rebinding, an attacker only needs to lure a developer to open a malicious page or load a malicious ad to execute arbitrary code against the local Ray dashboard or Jobs API. Weaponized by the RondoDox DDoS botnet and ShadowRay 2.0 GPU cryptomining campaigns; among 2026's most severe browser-side RCEs against AI infrastructure.

Incident Overview

Ray is an Anyscale-led open-source Python distributed computing framework, widely used to scale AI model training, inference, and data-processing jobs. GitHub: 43.5k stars, 7.9k forks; used by AI teams in finance, telecom, research, and startups. CVE-2025-62593 was first disclosed November 26, 2025 by Oligo researchers Avi Lumelsky and Jonathan Leitschuh, and fixed in Ray 2.52.0. BitSight reported in March 2026 that the RondoDox botnet had weaponized the bug two days before public disclosure; Oligo's concurrent ShadowRay 2.0 campaign turned GPU clusters into cryptomining botnets. CISA added CVE-2025-62593 to KEV on August 17, 2026; statutory patch deadline August 20.

Technical Details

• CVSS v4: 9.4 / Critical; network attack vector, low complexity, no privileges required.
• Trigger: Ray Dashboard and Jobs API (/api/jobs, /api/job_agent/jobs/).
• Root cause: Ray Dashboard historically left key endpoints unauthenticated, blocking browser cross-origin requests only by checking whether User-Agent starts with "Mozilla". Firefox, Safari, and others allow page scripts to rewrite User-Agent, bypassing the check. Combined with DNS rebinding, the victim's browser rebinds an external domain to a local or internal Ray instance, then issues arbitrary calls to the Ray Jobs API under same-origin policy.
• Impact: arbitrary shell commands under the Ray process; steal developer credentials, training data, model weights; load cryptominer payloads on GPU nodes.
• Lateral spread: the browser acts as a confused deputy and can attack Ray instances on the enterprise intranet in the same session, expanding the exposure.
• Preconditions: a Ray instance running locally or on the intranet while the developer browses the web or loads ads.

Impact Assessment

CISA adding CVE-2025-62593 to KEV is one of the few 2026 AI-infrastructure events with a mandatory three-day patch window:

• Confirmed industrial exploitation: RondoDox botnet has weaponized the bug; combined with ShadowRay 2.0, infected nodes spread to GPU clusters. More than 230,000 Ray instances exposed to the internet.
• Misplaced trust boundary: Ray's team assumed Dashboard runs on a trusted isolated network; many enterprises expose it to the public internet or dev nets, turning an intranet tool into a public attack surface.
• Concentrated high-value targets: AI training environments typically concentrate GPUs, training data, model weights, and researcher credentials—among 2026's most profitable targets.
• Patch speed is critical: CISA's three-day window for federal agencies signals high-priority weaponization. Private sector should follow the same timeline.

Remediation

• Upgrade to Ray 2.52.0 or later: patches the Dashboard cross-origin check and adds authentication (off by default; must be enabled manually).
• Isolate Dashboard and Jobs API: pull Ray off the public internet; access only via VPN, zero-trust proxy, or controlled subnet. Default port 8265 must not listen publicly.
• Enable authentication: on Ray 2.52.0+, enable token auth or enterprise SSO; whitelist Jobs API callers.
• Rebuild containers/CI/CD: rebuild all images and CI/CD templates containing old Ray versions; ensure dependency managers cannot pull old versions.
• Detection: watch unexpected job submissions on /api/jobs/, miners masquerading as system processes, abnormal cron/systemd persistence; flag known sideload behaviors in EDR (OneDrive, C: wtsapi32.dll, etc.).

References

• CISA: CVE-2025-62593 added to KEV catalog
• Cyber Security News: Ray RCE analysis
• The Hacker News: CISA flags Ray vulnerability as exploited in the wild
• Secure.com: Ray CVE-2025-62593 and RondoDox/ShadowRay correlation analysis