CISA mandates a three-day patch following an active attack on a vulnerability in the Ray AI framework.

      The U.S. cyber-defense agency has included a specific vulnerability in Ray, the open-source framework that supports a significant portion of global AI training and inference, in its Known Exploited Vulnerabilities catalogue, indicating that the flaw is being exploited in real-world attacks.

      On August 17, the Cybersecurity and Infrastructure Security Agency (CISA) instructed federal agencies to patch the software by August 20 or discontinue its use, presenting one of its tightest deadlines. The vulnerability, identified as CVE-2025-62593, is a code-injection issue that can grant an attacker remote code execution in a compromised Ray deployment. In simpler terms, an individual without login access could potentially command a target’s machine to execute their desired commands.

      CISA does not disclose specifics regarding exploitation, and we will refrain from doing so as well; the purpose of a KEV listing is not to explain how the attack is conducted, but to highlight that it is actively occurring. The catalogue serves as a tool for the agency, which has itself recently faced challenges due to the absence of its own incident-response playbook, to urge federal networks to address actively exploited vulnerabilities.

      Ray, managed by Anyscale, is central to contemporary machine-learning systems, distributing Python tasks across clusters of CPUs and GPUs. Its widespread use contributes to the seriousness of this vulnerability: the software typically operates across multiple expensive computing resources, which hold proprietary models, training datasets, and cloud credentials, rather than just on an individual laptop.

      Such systems are often quickly initiated by data-science teams and may be overlooked by those responsible for their security. Anyscale has resolved the issue in Ray version 2.52.0, leaving operators on earlier versions exposed. CISA's report indicates that the vulnerability is notable because it can be accessed via a standard web browser, such as Firefox or Safari, rather than needing direct network access to a Ray service. This significantly lowers the ease of exploitation, prompting the agency to act swiftly.

      The issue with Ray mirrors challenges faced by the open-source ecosystem. Commonly used infrastructure developed and maintained by relatively small teams becomes a critical single point of failure for downstream users, a situation highlighted during the Log4j crisis and the ensuing questions about open-source funding. The rise of AI has intensified these stakes, as the computational resources now linked to these frameworks are among the most valuable on any network.

      Ray clusters have been targeted in the past. Researchers at Oligo Security reported on a campaign called ShadowRay, related to a different, older Ray vulnerability, where over 230,000 internet-exposed servers were scanned, and compromised systems were exploited for cryptocurrency mining, credential theft, and extraction of entire repositories of source code and models.

      While the flaw listed by CISA this week is not the same as the earlier one, it serves as a reminder of the kinds of issues exposed Ray infrastructure can face, from cryptojacking that covertly takes over hardware to full-blown data theft. CISA notes that the vulnerability’s involvement in ransomware campaigns is currently “unknown,” indicating no verified extortion aspect at this time; the immediate threat remains unauthorized code execution and its potential repercussions.

      Nonetheless, this scenario follows a familiar pattern: a critical vulnerability, a patch is available, exploitation is confirmed, and the timeframe for action is shrinking as opportunistic attackers prepare to exploit it, similar to the situation with an actively exploited Java zero-day several years prior.

      For federal agencies, the deadline is firmly set for August 20 under CISA's binding-directive framework, which was first established by Binding Operational Directive 22-01 and is now regulated by the risk-based BOD 26-04. Although private-sector operators do not face a legal deadline, the government’s timeline serves as a reasonable indication of the urgency with which others should approach the issue.

      The guidance from security desks advises a calm yet firm approach: identify any Ray deployment within your network, verify if it can be accessed from external sources, restrict access, and promptly upgrade to version 2.52.0 before confirming whether you are already at risk.