CISA Mandates Patch for Actively Exploited RCE Flaw in Ray AI Framework

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical vulnerability in Ray, an open-source distributed computing framework used for AI and machine learning. The flaw is currently being exploited in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog on August 18, 2026.

The vulnerability, identified as CVE-2025-62593, enables browser-based Remote Code Execution (RCE). Security analysis indicates the attack is triggered through a combination of a fetch bypass and a DNS rebinding attack. The flaw affects all versions of the Ray framework prior to version 2.52.0, leaving a significant number of installations vulnerable if they have not yet been updated.

The Infrastructure at Risk

Ray is a Python-native framework designed to scale artificial intelligence and machine learning workloads across distributed clusters. Because it is built to handle high-compute tasks, it is often deployed in environments with access to sensitive training data and massive processing power. Previous research from Oligo Security highlighted the inherent risk of these deployments, noting that hundreds of thousands of Ray servers had been exposed to the public internet without proper authentication, creating a broad attack surface for RCE exploits.

Industry Implications

The ability to trigger RCE via a browser is particularly dangerous for AI/ML infrastructure. It allows attackers to potentially compromise high-compute clusters, steal proprietary models, or manipulate sensitive AI training datasets. By adding the flaw to the KEV catalog, CISA has mandated that all U.S. federal agencies patch the vulnerability immediately. This move signals a high level of urgency for the private sector as well, as the KEV list is typically reserved for flaws with proven, active exploitation that pose a systemic risk to infrastructure.

Next Steps for Users

Administrators are urged to update Ray to version 2.52.0 or later to mitigate the risk of DNS rebinding and fetch bypass attacks. Organizations should also audit their network configurations to ensure that Ray servers are not exposed to the public internet without strict authentication and firewall controls. While the technical mechanism of the exploit is known, security teams should continue to monitor for indicators of compromise within their AI clusters as more details on the active exploitation campaigns emerge.