CISA orders a three-day patch after a Ray AI flaw comes under active attack

The US cyber-defence agency CISA has added a single flaw in Ray, the open-source framework behind a large share of the world's AI training and inference, to its Known Exploited Vulnerabilities catalog, confirming the bug is being used in real attacks. As The Next Web reported, the agency made the move on August 17 and gave federal agencies until August 20 to patch or stop running the software, one of the tightest windows it issues.

The flaw

The bug is tracked as CVE-2025-62593, a code-injection weakness in Ray. Per Security Affairs, versions before 2.52.0 do not adequately protect the Ray dashboard and API against browser-based attacks, which opens the door to remote code execution on the machine running Ray. The Hacker News framed the danger the same way: a request that reaches an exposed Ray endpoint can end with an attacker running commands.

Why a browser-based path is the scary part

Ray is not an obscure library. It is the distributed-computing engine that many teams use to scale machine learning, data processing, and plain Python workloads, which means these dashboards often sit on internal networks or, worse, get exposed to the internet during development. Cybersecurity News notes the risk is highest for developers running vulnerable Ray dev environments. A browser-reachable endpoint that yields code execution is exactly the kind of soft target that gets swept up in mass scanning, which is likely why CISA moved this to active-exploitation status.

What to do now

• Upgrade to Ray 2.52.0 or later. That is the fix, and the three-day federal deadline is a fair signal of urgency for everyone else too.
• Get the dashboard off the open network. Bind it to localhost, put it behind authentication, and never expose the Ray API to the internet. Treat an internet-facing Ray dashboard as already compromised until proven otherwise.
• Hunt for exposure. Check your own footprint for reachable Ray ports and dashboards. A tuned SIEM helps you catch the scanning and post-exploitation noise that follows a KEV listing.

The takeaway

This is a clean example of AI infrastructure becoming attack surface. The same tooling teams rush to stand up for model training can hand an attacker a shell if it is left open, and the risk grows as more code and internal systems get wired into these frameworks, the same exposure worth watching alongside prompt injection. Patch Ray, close the dashboard, and if you want context on the broader run of enterprise credential and cloud incidents this month, see our coverage of the Azure data-theft campaign. Developers standing up local AI stacks can also read our cross-network guide on tooling for developers.