Active exploitation has pushed a critical Ray AI framework bug onto CISA’s Known Exploited Vulnerabilities catalog.
The flaw, CVE-2025-62593 (CVSS 9.4), allows remote code execution through web browsers. A DNS rebinding attack combined with a User-Agent fetch bypass lets a malicious website run shell commands on a developer’s machine when they visit a phishing page or are served a malicious ad.
The affected software is Ray, an open-source framework that distributes AI and machine learning jobs across clusters. Its codebase has been forked thousands of times, and its maintainers have long declined to put authentication on critical endpoints such as /api/jobs, a decision that underpins the flaw.
Victims are typically developers running Ray in test and development setups. With the browser standing in as a confused deputy, the compromise can spread sideways to additional Ray installations on the same internal network.
The issue was fixed in Ray 2.52.0, with credit going to Oligo researcher Avi Lumelsky for the fetch bypass and Jonathan Leitschuh for the DNS rebinding technique. CISA offers no detail on current exploitation, but a BitSight report from March tied the RondoDox DDoS botnet to the flaw, and unpatched clusters have been hit by the ShadowRay 2.0 crypto-mining campaign.
Federal civilian agencies have until August 20, 2026 to patch. Any shop running Ray for development should upgrade immediately and treat local Ray dashboards as untrusted.
