CISA Emergency Directive Requires Three-Day Patch for Ray Vulnerability: Botnet Weaponized Two Days Before CVE Disclosure

On August 17, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added the Ray distributed computing framework vulnerability CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog, leaving federal civilian executive branch agencies only a three-day window—deadline August 20—to complete patch deployment. CVE-2025-62593 carries a CVSS v4 score of 9.4, classified as critical, with the fix released in Ray 2.52.0.

This event marks the first time an AI/ML infrastructure toolchain has entered the CISA KEV catalog with "confirmed in-the-wild exploitation" status—a catalog previously almost exclusively reserved for operating systems, VPN gateways, and enterprise application software.

Root Cause: By Design, Not an Oversight

Ray is a Python-native open-source distributed computing framework with more than 43,500 stars and over 7,900 forks on GitHub, widely used for horizontally scaling AI training tasks and orchestrating inference clusters. On the root cause of CVE-2025-62593, the official Ray maintainers wrote in their security advisory:

"Due to the Ray development team's long-standing decision not to implement any authentication mechanism on critical endpoints (such as /api/jobs and /api/job_agent/jobs/), this has once again resulted in a critical vulnerability."

Ray by default assumes its dashboard and API endpoints run on trusted internal networks, with users responsible for securing network boundaries. This was acceptable in academic research environments, but the assumption has broken down as AI/ML workloads have entered enterprise production environments at scale.

Attackers combined User-Agent detection with DNS rebinding techniques to turn victims' browsers into "confused deputies." When developers browse malicious websites or encounter malicious ads, their browsers unknowingly send requests to Ray instances on localhost or internal networks, executing arbitrary shell code. Both Firefox and Safari can bypass this User-Agent detection.

Timeline Anomaly: Weaponization Preceded Disclosure

According to a report published by BitSight in March 2026, operators of the RondoDox DDoS botnet had integrated this vulnerability into their attack toolkit two days before the public disclosure date of CVE-2025-62593 (November 26, 2025).

The scale of weaponization was not limited to DDoS. According to a report from security firm Oligo, the active "ShadowRay 2.0" campaign targeting Ray clusters has converted infected Ray nodes equipped with NVIDIA GPUs into self-replicating cryptocurrency mining botnets. AI compute clusters inherently come with high-performance GPUs—the value of hijacking a single Ray node's compute power far exceeds that of compromising an ordinary web server.

Why AI/ML Environments Are Particularly Vulnerable Targets

Ray is typically hidden deep within the dependency trees of AI workloads as a Python package. This creates an asset discovery problem: enterprise security teams likely have no idea which machines are running Ray instances, or whether those instances are exposed to accessible networks.

AI/ML environments have long occupied a gray zone in security governance. Maintained by data scientists rather than systems engineers, these environments prioritize experimentation speed over security compliance and often enjoy fairly permissive network privileges within the corporate intranet. This makes a successfully compromised Ray node an extremely likely launching pad for lateral movement into the internal network.

Attackers are using phishing and malicious ad delivery to specifically target developers—focusing on engineers who run Ray locally. Once a developer's machine is compromised, attackers gain an active foothold into the enterprise internal network.

What the CISA Three-Day Window Really Means

CISA's KEV catalog has historical precedents of three-day windows, but they typically appear only in the most urgent circumstances—for example, when known targeted APT groups are actively exploiting a vulnerability against federal agencies. This three-day window indicates that CISA possesses substantial evidence of in-the-wild exploitation.

The August 20 deadline has passed, and the situation has entered a post-deadline verification phase. For federal agencies, the focus of verification extends beyond Ray itself to include all container images, Kubernetes deployments, and CI/CD pipelines that may embed Ray—because updating the main package does not eliminate older versions nested in dependency layers.

Independent Assessment

The systemic blind spot revealed by this incident is that AI/ML toolchains are entering enterprise production infrastructure far faster than security governance can keep pace. Frameworks like Ray, vLLM, Triton, and Kubeflow all originated in academic or research environments, where security was never the primary design objective. When they are moved directly into production environments with real attack surfaces, historical debts surface in the form of vulnerabilities.

Ray maintainers acknowledged that the absence of authentication was a "long-standing decision"—one that has now caused severe real-world damage. For teams using Ray for production inference services, this incident is a mandatory moment of re-examination: Are Ray clusters exposed to intranet-reachable networks? Is there network-level isolation? Is there an asset inventory that can answer "how many machines in our organization are running Ray"? If none of these three questions have good answers, then CVE-2025-62593 is only the beginning.