CISA labels actively exploited Ray CVE-2025-62593; upgrade to 2.52.0 now

A code-injection vulnerability in Ray, tracked as CVE-2025-62593, is being actively exploited in the wild, and CISA has given federal agencies just three days to patch. Any AI team running Ray clusters for training, inference, or multi-GPU workloads should treat this as a high-priority incident and upgrade to version 2.52.0 immediately.

CISA adds Ray vulnerability to KEV with three-day patch deadline

On 17 August, the Cybersecurity and Infrastructure Security Agency added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being used in real-world attacks. Federal agencies have until 20 August to patch or isolate Ray deployments under binding directives BOD 22-01 and BOD 26-04. The bug is a code-injection vulnerability that can give an attacker remote code execution on a vulnerable Ray deployment [https://thenextweb.com/news/cisa-kev-ray-ai-framework].

Ray, maintained by Anyscale, is widely used to distribute Python workloads across CPU and GPU clusters. It underpins many AI training and inference pipelines, meaning the affected deployments often hold proprietary models, training data, and cloud credentials.

Why the Ray AI framework is a high-value target

What makes this vulnerability especially dangerous is the attack vector. According to CISA, the flaw can be exploited through an ordinary web browser, including Firefox and Safari [https://thenextweb.com/news/cisa-kev-ray-ai-framework]. This lowers the bar considerably. An attacker does not need direct network access to the Ray service; they can reach it through a browser, making internet-exposed clusters easy prey.

This is not the first time Ray infrastructure has been targeted. In a previous campaign called ShadowRay, documented by Oligo Security, more than 230,000 internet-exposed servers were scanned, and compromised systems were mined for cryptocurrency, credentials, and source code [https://thenextweb.com/news/cisa-kev-ray-ai-framework]. That campaign used a different, older flaw, but it demonstrates what attackers will do once they gain access: from cryptojacking to outright data theft.

For builders, the implication is clear: your Ray cluster is a high-value asset, and this exploit makes it reachable without sophisticated network access.

What operators should do now

If you are running Ray on any version before 2.52.0, you are exposed. Anyscale fixed the issue in 2.52.0, so upgrading is the primary mitigation. Private operators should do three things:

• Inventory: Find every Ray deployment on your network. These are often spun up quickly by data science teams and may not be in your standard asset register.
• Isolate: Confirm whether each deployment is reachable from the internet or even from internal untrusted networks. Restrict access to necessary IPs and consider putting Ray behind a VPN or firewall.
• Patch: Upgrade to Ray 2.52.0 across all clusters. Do not wait to confirm whether you are already compromised. The three-day federal deadline is a good proxy for private-sector urgency.

Caveats

CISA has not published the specific exploitation details, and no independent confirmation of ransomware use has emerged. The known use in ransomware campaigns is listed as "unknown" [https://thenextweb.com/news/cisa-kev-ray-ai-framework]. The immediate risk is unauthorized code execution and the data theft or resource hijacking that follows. These limitations do not reduce the urgency: a browser-accessible RCE on infrastructure holding AI models and credentials is a clear and present danger.