At a glance:
- CISA has confirmed active exploitation of CVE-2025-62593, a critical Ray vulnerability that can allow remote code execution on systems running vulnerable deployments.
- Ray may be difficult to identify because it is often installed as a Python package within AI and machine learning environments rather than as a traditional enterprise application.
- Organizations using Ray are encouraged to locate deployments across developer systems, containers, Kubernetes clusters, and cloud-based AI infrastructure, and upgrade all instances to version 2.52.0 or later
Threat summary
On August 17, 2026, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability affects Ray, an open-source distributed computing framework widely used to scale AI, ML, data processing, and Python workloads across clusters of CPUs and GPUs. Ray is commonly deployed in development, research, and production environments that process proprietary models, datasets, and cloud credentials.
CVE-2025-62593 was addressed in version 2.52.0, affecting all previous Ray versions. It is described as a code injection vulnerability and was rated with a critical CVSS score of 9.4.
Researchers reported that the issue stems from insufficient protection of Ray dashboard and API endpoints against browser-based attacks. Ray relied on validation of the User-Agent header as a security control, which could be bypassed under certain conditions.
Researchers demonstrated that a threat actor could exploit this vulnerability through a DNS rebinding attack. In this scenario, a malicious website or advertisement tricks a victim's browser into communicating with a vulnerable Ray instance running on a local system or internal network.
Researchers reported that successful exploitation can lead to an arbitrary command execution on the affected system, allowing a threat actor to gain access to the affected system, steal credentials or sensitive data, move to other systems within the environment, and disrupt AI or data processing operations.
Evidence suggests threat actors moved quickly to weaponize the vulnerability after disclosure. Researchers reported that operators of the RondoDox distributed denial-of-service (DDoS) botnet incorporated CVE-2025-62593 into their toolkit within days of public disclosure.
Analysis
The vulnerability primarily affects environments where Ray is present on developer workstations, development servers, research infrastructure, AI platforms, cloud compute environments, or internal clusters. Organizations with active AI and ML initiatives are more likely to have Ray deployments that receive less visibility from traditional software inventory and vulnerability management processes.
Ray can be difficult to find because it is often installed by AI and ML teams as a Python package rather than as a standard enterprise application. As a result, it may not appear in traditional software inventories.
Ray is also commonly deployed in containers and Kubernetes environments used for model training and data processing. Container images, running containers, Kubernetes deployments, and AI platforms can contain Ray installations on systems that are managed outside normal endpoint management processes. Cloud-hosted AI environments and GPU servers are also common locations.
The platform commonly uses ports 8265 and 10001, with active deployments usually visible through network scans, firewall records, and cloud configuration reviews. In many environments, combining Python package searches, container reviews, Kubernetes inspections, and network discovery may provide visibility into where Ray is deployed.
Mitigation
Organizations running Ray would reduce risk by identifying instances across developer workstations, cloud environments, container images, Kubernetes clusters, and AI infrastructure. Build pipelines, dependency repositories, and container images are worth reviewing to confirm vulnerable versions have been removed.
Affected deployments should be upgraded to Ray version 2.52.0 or later. Organizations using Ray within containers, Kubernetes environments, or automated build pipelines may also need to update dependencies, rebuild images, and redeploy affected workloads to ensure vulnerable versions are fully removed.
Reviewing Ray dashboard and API exposure can help identify unnecessary access risks. Monitoring for unusual command execution, credential access, and activity involving Ray services may help identify exploitation attempts.
