CISA Issues Urgent Patch for Ray AI Framework Flaw
A code-injection bug in Ray, the open-source engine powering countless AI workloads, is actively being exploited in the wild. US federal agencies have until August 20th to patch it, and private operators are advised not to wait.
August 18, 2026 – 10:11 am
Credit: CISA
America’s cyber-defence agency, the Cybersecurity and Infrastructure Security Agency (CISA), has added a critical vulnerability in Ray—the open-source framework behind a significant portion of global AI training and inference—to its Known Exploited Vulnerabilities (KEV) catalogue. This confirms that the flaw is being actively exploited.
On August 17th, CISA issued an alert, giving federal agencies just three days to patch the software or discontinue its use.
The bug, tracked as CVE-2025-62593, is a code-injection weakness that grants attackers remote code execution privileges on vulnerable Ray deployments. In simple terms, this allows an attacker who has never logged in to execute commands on a target machine.
CISA does not disclose exploit details, and neither will we; the purpose of listing a KEV is not to explain how an attack works but to confirm that it is working.
This vulnerability is significant due to Ray‘s widespread use in modern machine learning pipelines, distributing Python workloads across clusters of CPUs and GPUs. Its ubiquity means operators often forget to secure these systems properly. Anyscale, the framework’s maintainer, has fixed the issue in Ray version 2.52.0; older versions remain vulnerable.
According to CISA, this flaw is unique as it can be exploited through an ordinary web browser, including Firefox and Safari, without requiring direct network access to a Ray service. This lowers the barrier for exploitation significantly.
Ray‘s vulnerability highlights broader concerns within the open-source community. Widely deployed infrastructure maintained by small teams becomes a single point of failure for everyone relying on it—a reality underscored by the Log4j crisis and subsequent funding questions regarding open-source projects. AI’s increased use of such compute raises the stakes even higher, as valuable network resources are now at play.
Ray clusters have been targeted before; Oligo Security researchers documented a campaign called ShadowRay, linked to an older Ray weakness, which compromised over 230,000 publicly exposed servers for cryptocurrency mining, credential theft, and even stealing source code and models.
While CISA doesn’t currently link the latest flaw to ransomware campaigns, it does mention "unknown" use cases, suggesting a potential risk of unauthorised code execution and its consequent consequences.