U.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Ray RCE flaw CVE-2025-62593 (CVSS 9.4) to its KEV catalog, ordering federal agencies to patch by August 20, 2026.
CISA added CVE-2025-62593 (CVSS 9.4), a critical remote code execution flaw in the Ray AI compute engine, to its Known Exploited Vulnerabilities catalog with a due date of August 20, 2026. Versions before 2.52.0 relied on a User-Agent header check to guard the dashboard/API, which combined with DNS rebinding allows arbitrary code execution on developers' machines via malicious websites or ads. Aviatrix's analysis describes privilege escalation, lateral movement, command and control, and data exfiltration following exploitation. Federal civilian agencies must remediate under BOD 22-01; the flaw affects Firefox and Safari.
- Ray versions before 2.52.0 lack effective protection against browser-based attacks on the dashboard/API
- Attack chain combines modified User-Agent headers with DNS rebinding to achieve RCE
- FCEB agencies must remediate by August 20, 2026 under BOD 22-01
- Aviatrix reports attackers escalated privileges, moved laterally, and exfiltrated data after exploitation
- CVEs
- CVE-2025-62593
- Products
- Ray
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-62593 | Actively Exploited Browser-Based RCE in Ray AI Compute Engine | 9.4 | 60% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Ray-Project Ray vulnerability to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.