CISA gives federal agencies three days to patch a Ray AI framework flaw under active attack

[Sentinel96]

The Cybersecurity and Infrastructure Security Agency added a Ray flaw to its Known Exploited Vulnerabilities catalog on August 17 and gave federal civilian agencies until August 20 to fix it, a remediation window of just three days rather than the older standard two week clock. Ray is an open source distributed computing framework that a huge share of AI and machine learning infrastructure quietly runs on, including workloads at Amazon, Apple and OpenAI, so this is not some obscure library nobody has heard of.

The bug itself, CVE-2025-62593, carries a CVSS score of 9.4 and comes down to a very specific and slightly absurd authentication check. Vulnerable versions of Ray try to block browser based attacks by checking whether the HTTP User-Agent header starts with Mozilla, except Firefox and Safari both let a script using the Fetch API rewrite that header freely. Combine that with a DNS rebinding attack and a developer simply visiting a malicious website, or even loading a compromised ad, can hand an attacker remote code execution against their own locally running Ray instance.

That local machine angle is what makes this one nasty in a different way from a typical internet facing server bug. The target is not some hardened production box behind a firewall, it is a developer's laptop or workstation running Ray for testing, which tends to have far less scrutiny and far more interesting data and credentials sitting around on it. The Ray maintainers put out an advisory back in November 2025 blaming a longstanding decision not to implement authentication on critical endpoints like the jobs API, and this latest exploitation confirms that decision is still costing people.

CISA's shortened three day window comes from a newer risk based directive, BOD 26-04, which replaced the flat fourteen day clock with something that scales the deadline to how dangerous and how automatable a given flaw actually is. Ray checks both boxes since it grants total control post exploitation and researchers say it is being actively targeted by at least one opportunistic botnet campaign as well as more targeted intrusion attempts under the ShadowRay banner.

The fix is available and it is not complicated, upgrade to Ray 2.52.0 or later. The harder problem, as more than one security team has pointed out, is inventory. A lot of organizations genuinely do not have a clean list of every machine quietly running Ray somewhere in a research cluster or a data scientist's environment, and building that list in three days is a much bigger lift than applying the patch once you have found every instance.

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCEthehackernews.com

[ThatGirl]

My team spent yesterday afternoon just building the inventory CISA is implicitly asking for and we are a company with maybe two hundred engineers. I genuinely do not know how a sprawling federal agency with legacy systems everywhere is supposed to pull this off by Thursday.

We will get there eventually, everyone always does, but calling this a three day fix undersells how much of the work is finding the thing before you can even start patching it.

[Amy_15]

People keep acting shocked that AI infrastructure has this many holes in it but honestly this whole ecosystem got built fast under enormous pressure to ship, and security hardening was never going to keep pace with that. We are watching the bill come due now.

[NatureBoyOwen16]

Anyone running Ray in a dev environment should assume it is exposed the second they browse the web on that same machine. DNS rebinding plus a bad User-Agent check is a well understood attack class at this point, there is really no excuse for a widely used framework shipping with it in 2025.

[NorthernKernel]

Three days is brutal for a framework this sprawling. I have seen Ray deployed by teams who barely remember they installed it a year ago, buried in some notebook environment nobody looks at until it breaks. Finding every instance is going to take most agencies longer than fixing the ones they do find.

[Erin82]

The Mozilla string check is almost funny if it were not so serious. Checking a header that any browser scripting environment can just rewrite is basically no security at all, it is the kind of thing that looks like a control on paper and does nothing in practice.

[HostFalcon]

Curious how many of the ransomware crews are already probing for this given how fast these KEV listings tend to get weaponized once they are public knowledge. CISA marked the ransomware field as unknown but that rarely stays true for long once a CVSS 9.4 with a public writeup is sitting out there.