CISA Orders Federal Agencies to Patch Actively Exploited Flaw in Ray AI Framework

CISA added CVE-2025-62593, a critical remote-code-execution flaw in Ray — the open-source distributed computing framework used by Amazon, Apple, and OpenAI to scale AI and machine-learning workloads — to its Known Exploited Vulnerabilities catalog on August 17, giving federal agencies just three days, until August 20, to patch it.

The bug, rated 9.4 out of 10 on the CVSS severity scale, stems from Ray's dashboard checking only whether a browser's User-Agent header starts with "Mozilla" — a value trivially spoofed. Combined with a DNS-rebinding attack, it lets a malicious website or ad silently run code on a developer's machine the moment they visit it in Firefox or Safari, no click required.

Attackers have already weaponized the flaw: unpatched Ray clusters running Nvidia GPUs have been hijacked into a self-replicating cryptocurrency-mining botnet dubbed ShadowRay 2.0, while the RondoDox DDoS botnet reportedly folded in the exploit before it was even publicly disclosed. Ray 2.52.0 fixes the issue; CISA is urging private organizations to patch on the same timeline as federal agencies.