CVE-2025-62593 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2025-11-26

Added to CISA KEV: 2026-08-17 264 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV with confirmed active exploitation. Treat as an emergency. Check for indicators of compromise immediately: review Ray job execution logs for unauthorized jobs, check for unexpected processes spawned by the Ray worker, audit outbound network connections from Ray hosts, and verify integrity of AI model artifacts and training data.
PATCH IMMEDIATELY: Upgrade Ray to version 2.52.0 or later. The patch implements proper request validation that does not rely on the bypassable User-Agent header check.
INTERIM MITIGATION (if patching is not immediately possible): Ensure Ray dashboard (default port 8265) is bound to localhost only and not accessible from untrusted network segments. Add network-level firewall rules blocking external access to Ray ports (8265, 10001, 6379, 8076, 8077).
BROWSER HYGIENE: While running Ray development environments, avoid browsing untrusted websites or clicking on advertisement links, particularly in Firefox or Safari. Consider using a separate browser profile or isolated browser session for general web browsing during active Ray development.
NETWORK SEGMENTATION: Ensure Ray clusters are deployed in isolated VPCs or private network segments with no direct internet ingress. Apply security group/firewall rules that restrict Ray dashboard access to known administrative IPs only.
MONITOR FOR MALVERTISING: Alert security teams that AI/ML developer workstations are active targets. Implement DNS filtering and ad-blocking at the network level for developer environments to reduce malvertising exposure.
THREAT HUNTING: Search for RondoDox botnet indicators of compromise (reference BitSight analysis) on hosts running Ray. Look for unexpected scheduled tasks, new user accounts, or persistence mechanisms installed after Ray process activity.
PATCH PRIORITY: CRITICAL — patch within 24-48 hours given active exploitation and CISA KEV status.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2025-62593 is a critical remote code execution (RCE) vulnerability affecting Ray, a popular distributed computing framework used for AI and machine learning workloads. The vulnerability stems from insufficient protection against browser-based attacks, as the software relied on a flawed defense mechanism that inspected the `User-Agent` header to filter requests. Because this check could be easily bypassed, attackers can leverage DNS rebinding techniques in browsers like Firefox and Safari to trick a developer's local Ray instance into executing arbitrary code, posing a severe risk to development environments.

Exploitation

Active Exploitation: The vulnerability is confirmed to be under active exploitation in the wild and was added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog in August 2026 ^[1]^[4].
Threat Actors: While specific campaigns are often obscured, the inclusion in the CISA KEV catalog indicates widespread use by malicious actors targeting the AI/ML developer ecosystem ^[1].
Availability: Technical details and proof-of-concept concepts regarding DNS rebinding against Ray are publicly documented, facilitating exploitation ^[5].
Attack Prerequisites: Exploitation is network-based but relies on the victim browsing to a malicious site while running a vulnerable Ray instance locally. It does not require authentication from the attacker, but it does require user interaction (the victim must visit an attacker-controlled URL) and the use of specific browsers (Firefox or Safari) where the DNS rebinding attack can be effectively staged ^[2]^[3].

Affected Products & Patches

Affected Versions: Ray versions prior to 2.52.0 are vulnerable ^[3]^[7].
Patch Availability: The issue was resolved in Ray version 2.52.0, which implemented proper request validation that does not rely on the `User-Agent` header ^[6].
Mitigations: Users are strongly advised to update to version 2.52.0 or higher. For systems that cannot be immediately patched, ensuring that local Ray dashboard ports are not exposed to untrusted network traffic and practicing safe browsing habits—specifically avoiding untrusted websites while development environments are active—can provide limited defense.

Impact

System Access: Successful exploitation provides attackers with remote code execution capabilities on the host machine running the Ray instance, effectively granting them the same privileges as the user running the development environment.
Business Risk: For internet-facing or collaborative deployments, this vulnerability can lead to total system compromise, exfiltration of sensitive AI model weights, training data theft, and the use of development infrastructure to launch further internal network attacks. The active exploitation status emphasizes that development workstations should be treated as high-value targets by attackers looking to pivot into corporate research and development networks.

Sources

CISA Adds One Known Exploited Vulnerability to Catalog
This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding ...
Ray is vulnerable to Critical RCE via Safari & Firefox ...
Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who ...
NVD-CVE-2025-62593
CVE-2025-62593 Detail Description Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari.
CISA Flags Actively Exploited Ray Flaw That Can ... - The Hacker News
CISA adds actively exploited Ray flaw CVE-2025-62593 to KEV; DNS rebinding can trigger browser-based RCE on developer systems. ... CISA adds actively exploited Ray flaw CVE-2025-62593 to KEV; DNS rebinding can trigger browser-based RCE on developer systems.
Ray CVE-2025-62593: Critical Browser-Driven RCE via ...
CVE-2025-62593 is a critical remote code execution vulnerability in Ray, a distributed computing framework widely used for Python and ...

🟡 CVE-2025-62593