The U.S. Cybersecurity and Infrastructure Security Agency added a critical Ray flaw tracked as CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog on August 17, 2026, giving federal civilian agencies until August 20 to patch after Oligo Security researchers confirmed the browser-based remote-code-execution bug is being actively exploited in the wild.
DNS rebinding turns a browser tab into a Ray takeover
CVE-2025-62593 carries a 9.4 CVSS score and affects every Ray release before 2.52.0. Ray's dashboard and job APIs relied on a "Mozilla" User-Agent prefix as their only guard against browser-originated requests, a check the fetch specification allows any browser to bypass. Combined with a DNS rebinding attack, an attacker who tricks a developer into loading a malicious page or malvertising in Mozilla Firefox or Apple Safari can execute arbitrary shell code on the developer's machine and pivot laterally to any Ray cluster the workstation can reach.
Active exploitation traced back to RondoDox and ShadowRay 2.0
BitSight told researchers that the RondoDox DDoS botnet integrated the Ray flaw two days before responsible disclosure on November 26, 2025, thanks to a public proof-of-concept. Oligo separately linked unpatched Ray endpoints to ShadowRay 2.0, a self-replicating cryptomining campaign that hijacks NVIDIA-GPU clusters. Ray maintainer Anyscale credited Oligo researcher Avi Lumelsky with discovering the fetch bypass and Jonathan Leitschuh for chaining it with DNS rebinding.
KEV clock is ticking for federal agencies and their private-sector peers
Binding Operational Directive 22-01 obliges Federal Civilian Executive Branch agencies to remediate every KEV entry by its due date, but CISA and industry analysts recommend private organizations follow the same schedule when the vulnerability is being weaponized. Enterprises are advised to inventory Ray installs across developer laptops, CI/CD runners, container images, Kubernetes clusters and GPU cloud environments before pushing the 2.52.0 upgrade.
The addition follows earlier August KEV entries linked to an N-central patch-bypass exploited against MSPs, the Broadcom vCenter auth-bypass chain disclosed in VMSA-2026-0006, and the August 5 Langflow and Apache Tomcat KEV push. Ray now joins a growing cluster of AI-tooling flaws under active exploitation.
Reporting based on coverage from The Hacker News, Security Affairs and CISA.