CISA orders 3-day patch for Ray AI flaw under active attack

America’s cyber-defense agency has formally added a critical flaw in Ray, the widely used open-source framework for AI training and inference, to its Known Exploited Vulnerabilities catalog, a move that confirms attackers are actively leveraging the bug in the field.

The Cybersecurity and Infrastructure Security Agency issued the alert on August 17, imposing a deadline of August 20 for federal agencies to either apply the patch or discontinue use of the software. That three-day window ranks among the tightest the agency has ever mandated.

The vulnerability, designated CVE-2025-62593, stems from a code injection flaw that enables remote code execution on affected Ray deployments. In straightforward terms, an unauthenticated attacker can force a victim’s machine to execute arbitrary commands without ever logging in. CISA has not disclosed specific exploit mechanics, and this piece will not either; the significance of a KEV listing lies not in how the attack operates, but in the fact that it is already happening in the wild.

This catalog serves as the same mechanism CISA uses to compel federal networks to close security gaps that are being actively exploited. The agency itself has faced scrutiny recently for lacking its own incident-response playbook, yet it continues to push this directive outward.

Ray, maintained by Anyscale, underpins much of the modern machine-learning stack, distributing Python workloads across clusters of CPUs and GPUs. That centrality is precisely why the vulnerability carries such weight. The software rarely sits on a single machine; it runs across pools of expensive compute resources that hold proprietary models, training datasets, and cloud credentials.

These systems are often spun up quickly by data science teams, then left unmanaged by whoever is nominally responsible for security. Anyscale has resolved the issue in Ray version 2.52.0, leaving operators on older releases exposed.

What makes this particular flaw stand out, according to CISA’s entry, is its accessibility through an ordinary web browser, including Firefox and Safari, without requiring direct network access to a Ray service. That significantly lowers the barrier to exploitation and explains the agency’s urgency.

Ray’s predicament mirrors a broader challenge within the open-source ecosystem. Infrastructure that is widely deployed yet maintained by relatively small teams becomes a single point of failure for everyone downstream. The Log4j crisis laid this dynamic bare, sparking ongoing debates about open-source funding and sustainability. AI has intensified the stakes, as the compute power behind these frameworks now ranks among the most valuable assets on any network.

This is not the first time Ray clusters have drawn malicious attention. Researchers at Oligo Security documented a campaign dubbed ShadowRay, tied to an earlier and separate Ray vulnerability, in which over 230,000 internet-exposed servers were scanned. Compromised systems were then mined for cryptocurrency, harvested for credentials, and stripped of entire repositories containing source code and models.

That older flaw is distinct from the one CISA flagged this week, but it offers a preview of what exposed Ray infrastructure attracts: from cryptojacking that silently hijacks hardware to outright theft of sensitive data. CISA lists the current vulnerability’s use in ransomware campaigns as “unknown,” so no confirmed extortion angle exists yet. The immediate threat is unauthorized code execution and the cascading consequences that follow.

Still, the pattern is recognizable: a critical flaw emerges, a patch becomes available, exploitation is confirmed, and opportunistic attackers rush in before the window closes. Federal agencies face a hard deadline of August 20 under CISA’s binding-directive framework, originally established by Binding Operational Directive 22-01 and now governed by the risk-based BOD 26-04. Private-sector organizations face no legal mandate, but the government’s timeline serves as a sensible benchmark for how urgently everyone else should respond.

The practical guidance for security teams is straightforward: locate any Ray deployment on your network, determine whether it is externally reachable, restrict access, and upgrade to version 2.52.0 without delay. Waiting to find out whether you are already on an attacker’s list is not a viable strategy.