CVE-2025-62593 — a critical Ray vulnerability that can deliver remote code execution through web browsers such as Mozilla Firefox and Apple Safari — has been added to CISA’s Known Exploited Vulnerabilities catalog after evidence of active exploitation, the agency said.
CVE-2025-62593: browser-based RCE via DNS rebinding
The flaw identified as CVE-2025-62593 (CVSS 9.4) can result in remote code execution by leveraging a DNS rebinding attack against browsers. Ray project maintainers said the weakness stems from insufficient controls against browser-based attacks, specifically where the User‑Agent header can be modified. In their advisory, the maintainers wrote that a "longstanding decision by the Ray Development team to not implement any sort of authentication on critical endpoints, like the /api/jobs & /api/job_agent/jobs/ has once again led to a severe vulnerability that allows attackers to execute arbitrary code against Ray."
How the attack can be staged: confused-deputy and developer-facing risk
According to the Ray maintainers, an attack can succeed when a developer running Ray in a development or testing environment visits a malicious website or is served a malicious advertisement. Combined with a DNS rebinding attack against the browser, the exploit can be used to execute arbitrary shell code on the developer’s machine. The maintainers also warned that the browser can be used as a "confused deputy" intermediary to reach Ray instances running on private, network‑adjacent systems inside corporate networks.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRay, the patch, and credited researchers
Ray is an open-source, Python‑native distributed computing framework intended to scale AI and machine‑learning workloads. The GitHub project has more than 43,500 stars and has been forked over 7,900 times. Ray maintainers fixed the defect in version 2.52.0 of the Python package and credited Oligo security researcher Avi Lumelsky with discovering the fetch bypass and Jonathan Leitschuh with developing the DNS rebinding approach that underpins the attack scenario.
Evidence of exploitation: RondoDox and ShadowRay 2.0
CISA added the flaw to its KEV catalog on the basis of active exploitation, but the agency has not shared technical details of how the vulnerability is being used in the wild. Outside reporting cited by the announcement provides additional signals: a BitSight report from March 2026 said the threat actors behind the RondoDox DDoS botnet incorporated the vulnerability into their toolkit two days before the vulnerability’s public disclosure on November 26, 2025, following publication of a proof‑of‑concept exploit. Oligo also reported that unpatched Ray instances were targeted in campaigns aiming to convert infected clusters with NVIDIA GPUs into self‑replicating cryptocurrency‑mining botnets under the name ShadowRay 2.0.
What this means for developers, FCEB agencies, and enterprises
- Developers: The defect primarily impacts developers running Ray in development or testing contexts; a single visit to a malicious page or a malicious ad can lead to arbitrary shell execution on the developer’s host. Updating to Ray 2.52.0 is the corrective action identified by the project.
- Federal Civilian Executive Branch (FCEB) agencies: In light of active exploitation, FCEB agencies were recommended to apply necessary fixes and mitigations by August 20, 2026.
- Enterprises operating GPU clusters: Unpatched Ray instances were reported as targets in campaigns (ShadowRay 2.0) that sought to weaponize clusters with NVIDIA GPUs for cryptomining, and network‑adjacent instances may be reachable via browser‑mediated rebinding attacks.
Closing observation
CISA’s KEV listing confirms active exploitation and elevates the urgency of patching: Ray maintainers published a fix in 2.52.0, researchers tied the vulnerability to both RondoDox and ShadowRay 2.0 activity, and FCEB agencies carry a formal remediation deadline of August 20, 2026. The public record in this announcement underscores two linked facts: a proof‑of‑concept exploit was available around the time of disclosure, and attackers moved quickly to adopt it. Whether development environments and GPU clusters have been patched at scale by the agency deadline remains the practical question left by this alert.
