On August 17, 2026, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, setting a remediation deadline of August 20 for federal agencies. The vulnerability affects Ray, an open-source framework for distributing machine learning workloads across cloud and on-premise clusters. The attack exploits a flaw in dashboard access controls, enabling remote code execution through Safari and Firefox.
- CISA added CVE-2025-62593 to the KEV catalog on August 17, 2026, citing evidence of active in-the-wild exploitation
- The vulnerability carries a CVSS 4.0 score of 9.4 on the CRITICAL scale per the official CVE.org record
- The attack vector uses DNS rebinding via Safari and Firefox to bypass User-Agent-based protection
- Ray versions prior to 2.52.0 are vulnerable; federal agencies must remediate by August 20, 2026
How a Check on 'Mozilla' Opened the AI Framework
The flaw resides in the protection logic for Ray's dashboard and APIs. According to Aviatrix technical analysis cited by SecurityAffairs, the system verified that the HTTP User-Agent header began with the string "Mozilla" to deem a request legitimate. This pattern is manipulable: any client can present an arbitrary User-Agent satisfying that criterion.
The attacker combines this weakness with a DNS rebinding technique. The malicious domain initially resolves to an external IP address, then — with a short TTL — the same domain resolves to the Ray server's internal IP address. The browser maintains the session, treating it as same-origin, allowing requests to the Ray dashboard. From there, code injection enables remote execution.
Sources do not fully reproduce the technical details of the DNS rebinding mechanism. The description above summarizes the partial Aviatrix analysis reported by SecurityAffairs. The brief explicitly flags this limitation: "Complete technical details of the DNS rebinding exploit mechanism (Aviatrix analysis partially described but not fully reproduced in sources)".
The CVE.org record classifies the vulnerability as CWE-94, "Improper Control of Generation of Code." The official CVE title reads: "Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack." The CNA is GitHub, which manages the Ray project.
"An attacker exploited a code injection vulnerability in Ray AI Compute Engine via a DNS rebinding attack, leading to remote code execution. This allowed the attacker to escalate privileges within the system, move laterally across the network, establish command and control channels, exfiltrate sensitive data, and ultimately disrupt operations." — Aviatrix analysis, reported by SecurityAffairs
The Aviatrix quote describes an extensive compromise scenario. However, the brief does not independently verify this impact chain. Sources do not specify whether the attacker can access training data, proprietary models, or weights in deployment — these consequences are reported as Aviatrix vendor analysis, not as facts corroborated by multiple sources.
The Regulatory Context: BOD 26-04
CISA issued Binding Operational Directive 26-04 for federal civilian executive agencies. The remediation deadline is August 20, 2026. The brief states CISA recommends "forensic triage and discontinuing use if mitigations unavailable." The CISA source does not explicitly cite "documented compensating controls" as a BOD requirement.
The CISA KEV catalog lists the vulnerability as "Ray-Project Ray Code Injection Vulnerability" with reference to exposure via Firefox and Safari. The official alert of August 17, 2026 states inclusion is "based on evidence of active exploitation." The ransomware usage field in the KEV catalog reads "Unknown" for this entry.
SecurityWeek, citing BitSight, reports the vulnerability is exploited by the RondoDox botnet. This Mirai-inspired malware employs 174 distinct exploits. This data comes from a single BitSight observation via SecurityWeek; it is not corroborated by other sources in the dossier.
- RondoDox: reported by single source (SecurityWeek/BitSight), not independently corroborated
- DNS rebinding technical details: based on partial Aviatrix analysis, not fully reproduced in sources
- Elements with multi-source convergence: CVE identifier, CVSS score, KEV date, BOD deadline, CWE-94 classification
Why Ray Is a Strategic Target
Ray is infrastructure for AI/ML workload deployment. Developed by Anyscale and maintained as an open-source project, it handles distributed training, model serving, and pipeline orchestration across heterogeneous clusters. Typical installations span development environments, CI/CD systems, cloud instances, and Kubernetes clusters.
Ray's dashboard is a web interface that inherits traditional browser assumptions. Client-side User-Agent checking as a security barrier is a recognized anti-pattern. The source does not specify whether a publicly exposed instance permits access to the entire underlying cluster; this is author inference not verified by the brief.
What to Do Now
Organizations running Ray must verify the installed version. Sources indicate 2.52.0 as the remediation threshold: earlier versions are vulnerable. U.S. federal agencies operate under the BOD 26-04 time constraint.
CISA recommends forensic triage to identify any prior compromise. If mitigations are unavailable, the brief reports the recommendation to "discontinue use."
The brief does not list: specific network isolation for DNS resolution, monitoring for the RondoDox botnet as an actor, log examination for rapid DNS patterns or geographic origins, hardening checklists, or credential or token rotation. If suggested, these would be editorial recommendations not verified by the brief.
The Line Between Web Convention and Infrastructure Security
CVE-2025-62593 shows how controls inherited from the traditional web can become dangerous in compute infrastructure. Verifying the "Mozilla" User-Agent was convention, not security.
The case fits a broader pattern: AI/ML development and orchestration tools rapidly gain operational relevance but inherit dated threat models. CISA recognized this criticality by adding the vulnerability to the KEV catalog with a three-day remediation priority.
Sources
- GBHackers — CISA KEV addition, CVE details, remediation deadline: https://gbhackers.com/ray-project-ray-code-injection-vulnerability/
- SecurityWeek — BitSight observation of RondoDox botnet: https://www.securityweek.com/in-other-news-zombie-card-attack-t-mobile-cut-cable-to-stop-hackers-github-denies-ai-caused-bug/
- SecurityAffairs — Aviatrix technical analysis, affected versions, DNS rebinding: https://securityaffairs.com/197419/security/u-s-cisa-adds-a-ray-project-ray-flaw-to-its-known-exploited-vulnerabilities-catalog.html
- CVE.org — Authoritative CVE record, CVSS 9.4 CRITICAL, CWE-94: https://www.cve.org/CVERecord?id=CVE-2025-62593
- CISA — Known Exploited Vulnerabilities Catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA — Official alert, BOD 26-04, active exploitation evidence: https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog
Information verified against cited sources and current as of publication.
Sources
- https://gbhackers.com/ray-project-ray-code-injection-vulnerability/
- https://www.securityweek.com/in-other-news-zombie-card-attack-t-mobile-cut-cable-to-stop-hackers-github-denies-ai-caused-bug/
- https://securityaffairs.com/197419/security/u-s-cisa-adds-a-ray-project-ray-flaw-to-its-known-exploited-vulnerabilities-catalog.html
- https://www.cve.org/CVERecord?id=CVE-2025-62593
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog
- https://securityaffairs.com/197610/security/polands-cert-warns-of-active-exploitation-of-critical-zimbra-collaboration-suite-flaw.html