CISA Gives Feds 3 Days to Patch Actively Exploited Ray RCE

CISA added a critical remote-code-execution flaw in Ray — the open-source framework used to distribute Python and machine-learning workloads across GPU clusters — to its Known Exploited Vulnerabilities catalog on August 17. The deadline for federal civilian agencies is August 20. The bug is browser-reachable. RondoDox weaponized it before the public CVE was assigned. And Ray runs inside the AI infrastructure at Amazon, Apple, and OpenAI.

If you operate Ray below 2.52.0, this is not library hygiene. It is an active path into AI compute, and the clock is set to Wednesday.

What's Actually in the Story

The KEV addition is unusually aggressive. Three-day KEV remediation windows are not common — they are reserved for vulnerabilities where exploitation is already observable, the blast radius is large, and remediation is operationally tractable. CVE-2025-62593 meets all three. CVSS 4.0 score: 9.4. CISA cited active exploitation by named threat actors in the alert, issued the same day as the public CVE. The deadline for federal civilian agencies under BOD 26-04 is August 20.

The bug is browser-reachable. The exploit chain uses DNS rebinding — a malicious website resolves a hostname to an internal IP, then talks to a Ray dashboard that the user thought was local. No authentication. No phishing link. A user browsing the wrong site on Firefox or Safari while a Ray dashboard runs on localhost:8265 can trigger remote code execution on the host. The fix landed in Ray 2.52.0; the current release is 2.57.0.

RondoDox was inside before disclosure. RondoDox — the botnet operator known for large-scale DVR and router exploitation — weaponized the Ray vulnerability two days before the public CVE was assigned. The pattern is the same as Mirai derivatives: opportunistic, fast, and aimed at GPU instances for both cryptomining and pivot infrastructure. The pre-disclosure weaponization means the standard "wait for the patch and the dust to settle" posture doesn't apply here. The dust settled two days before the CVE number was issued.

ShadowRay 2.0 is the ongoing GPU-mining operation. Researchers have been tracking ShadowRay 2.0 — a campaign targeting misconfigured Ray instances for self-replicating cryptomining on NVIDIA GPU clusters. The campaign predates CVE-2025-62593 and continues to operate against Ray installs that haven't patched. The economics are worse than consumer-grade cryptomining: an NVIDIA H100 or A100 silently mining for a botnet operator is a six-figure asset generating pennies per day for an attacker, while the owner is paying the power bill and the latency cost.

Why This Matters for Builders

If you run Ray in production — directly or through an upstream tool that uses it — your exposure model just changed in three ways.

1. "Internal" is no longer a real perimeter. The standard developer answer to "is this internet-facing?" has historically been "no, it's only on the internal network." DNS rebinding turns that answer into a load-bearing lie. A service is reachable from any browser that can be tricked into talking to it. This is true for Ray today, and it will be true for the next framework you adopt. Treat any service running on localhost or behind a VPN as internet-reachable until proven otherwise.

2. Inventory is the first casualty. Most organizations do not have a clean inventory of where Ray runs. It appears in local development setups, ephemeral test environments, research clusters, and long-lived internal services. Security teams may not know which business units depend on it. If you cannot answer "where is Ray running in our org, and which version is each instance," the August 20 federal deadline is the cheapest forcing function you will get this year.

3. AI compute is now an explicit security target. Until this year, the KEV catalog has been dominated by perimeter and identity-layer vulnerabilities. CVE-2025-62593 is the first widely-deployed AI compute framework to land there. It will not be the last. The market for GPU instances — both legitimate and stolen — is large enough that botnet operators are treating it as a target class. Procurement, vendor diligence, and incident-response playbooks need to start asking the question: "what AI compute frameworks do we run, and what is their CVE posture?"

4. The active-exploitation flag changes the response cost-benefit. A CVE with a 9.4 CVSS score and no active exploitation is a prioritized backlog item. A CVE with a 9.4 CVSS score and named botnet operators in the wild is a 72-hour incident. Federal agencies are being told to patch by Wednesday for a reason. If you are not bound by BOD 26-04, you should still treat the same window as your own deadline. The cost of an emergency patch this week is lower than the cost of explaining a successful intrusion next quarter.

What to Actually Do With This

If you run Ray: Patch order is the obvious first move — upgrade to 2.52.0 or later (2.57.0 is current). The non-obvious move is the inventory: where else is Ray deployed, including developer laptops, CI runners, and ephemeral research environments. The browser-reachable nature of the bug means a developer with an unpatched Ray dashboard at home is now a potential initial-access point to any cloud credentials on that machine. Treat the patch as the floor, not the ceiling.

If you ship an AI product that depends on Ray upstream: This is your vendor-risk moment. The same procurement questions that mattered for the Anthropic Risk Report apply here: what version of the framework are you running, what is your patching SLA, and what is your detection coverage for browser-reachable services? If your product documentation does not answer those three questions in writing, your enterprise buyers will start asking them.

If you run a security org: BOD 26-04 binds federal civilian agencies, but the KEV catalog is also the most useful filter for the rest of the market. CISA does not add vulnerabilities to KEV casually. When a bug lands there with a three-day window, the signal is "patch now, sort out process later." Use this incident as the excuse to formalize a "KEV-or-equivalent" rapid patch policy for your own infrastructure, even if you are not a federal agency.

If you build developer tools or AI infrastructure: The browser-reachable RCE pattern is going to repeat. Ray is not the only framework with a local-control-plane story and a permissive default. Audit your own products for the same exposure class: a service that runs on localhost by default, accepts unauthenticated requests, and can be reached via DNS rebinding. If any of those three conditions are true, you have a CVE-2025-62593-shaped problem waiting to be discovered.

The Bigger Take

The AI compute stack is now a named target class. CVE-2025-62593 is the first AI infrastructure framework on the KEV catalog; it is unlikely to be the last. The frameworks that go next will share two traits: they run on developer machines by default, and they were designed before browser-based DNS rebinding was a mainstream attacker technique.

The KEV window matters. Three-day deadlines are the signal that the threat is not theoretical. The fact that RondoDox weaponized this bug before the CVE number was assigned tells you that the botnet economy is now operating inside the disclosure window. The shadow economy has been inside the AI compute perimeter for at least the duration of ShadowRay 2.0; CISA just made that visible.

If you ship anything in AI infrastructure, this is the week to update your incident-response runbooks, your vendor-risk questionnaires, and your internal "is this thing patched?" checklist. The first AI compute framework just hit KEV. The clock is set to Wednesday.

---

Sources: CISA KEV Catalog alert (cisa.gov). TheITGuys breakdown of the three-day federal deadline (theitguysfix.com). ComplianceHub on BOD 26-04 binding and shadow-compute exposure (compliancehub.wiki). Innovation Network Design on RondoDox weaponization pre-disclosure (innovationnetworkdesign.com). AIWeekly coverage (aiweekly.co).