CISA Mandates Patch for Actively Exploited Ray AI Engine Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in the Ray AI compute engine to its Known Exploited Vulnerabilities (KEV) catalog. Following the listing on August 18, 2026, federal agencies are required to remediate the flaw by August 21, 2026.

Tracked as CVE-2025-62593, the vulnerability affects all versions of Ray prior to 2.52.0. The flaw allows an attacker to trigger RCE on a developer's local system by leveraging DNS rebinding to bypass the browser's same-origin policy. This technique enables a malicious website to reach the local Ray dashboard on port 8265. Technical analysis indicates the attack is particularly effective in Firefox and Safari because their 'fetch' implementations allow scripts to modify the 'User-Agent' header, which bypasses Ray's weak internal check for 'Mozilla' browser traffic.

The AI Infrastructure Risk

Ray is widely utilized as a distributed compute engine for managing large-scale AI and machine learning workloads. A fundamental security challenge is that Ray often exposes job endpoints without authentication by default. While the Ray dashboard attempts to block unauthorized browser traffic, the current check is insufficient to stop sophisticated rebinding attacks. The dashboard's attempt to block browser traffic relies on a weak check that can be easily circumvented.

Implications for Secure Environments

This vulnerability is significant because it specifically targets developers and data scientists who typically possess high-level administrative access to private corporate networks and AI clusters. By using phishing or malvertising to lure a target to a malicious page, an attacker can gain an initial foothold inside a secure environment. Once the developer's machine is compromised, the attacker can potentially pivot to access sensitive AI models, proprietary training data, and critical infrastructure.

Next Steps for Remediation

Organizations using Ray are urged to update to version 2.52.0 or later immediately to close the RCE vector. Security teams should also evaluate their internal network configurations to ensure that AI compute endpoints are not exposed to untrusted traffic. While CISA has mandated the fix for federal agencies, the active exploitation of the flaw suggests that private sector entities running AI workloads are at similar risk.