America’s cyber-defence agency has added a single vulnerability in Ray, the open-source framework that powers a large slice of the world’s AI training and inference, to its Known Exploited Vulnerabilities catalogue, confirming that the flaw is being used in real-world attacks.

The Cybersecurity and Infrastructure Security Agency made the move on 17 August, giving federal agencies until 20 August to patch the software or stop running it, one of the tightest windows it issues.

The bug, tracked as CVE-2025-62593, is a code-injection weakness that can hand an attacker remote code execution on a vulnerable Ray deployment. In plain terms, someone who has never logged in could get a target’s machine to run commands of their choosing.

CISA does not publish exploitation details, and neither will we; the point of a KEV listing is not how the attack works but that it is already working.

The catalogue is the same mechanism through which the agency, itself recently caught without its own incident-response playbook, presses federal networks to close actively exploited holes.

Ray is maintained by Anyscale and sits at the heart of modern machine-learning pipelines, distributing Python workloads across clusters of CPUs and GPUs.

That ubiquity is exactly what makes the vulnerability serious: the software rarely runs on a single laptop, but across pools of expensive compute holding proprietary models, training data, and cloud credentials.

It is the kind of system that tends to be spun up fast by data-science teams and then quietly forgotten by whoever is meant to be securing it. Anyscale has fixed the issue in Ray version 2.52.0, so the operators still on earlier releases are the ones exposed.

According to CISA’s entry, the flaw is unusual in that it can be reached through an ordinary web browser, including Firefox and Safari, rather than requiring direct network access to a Ray service. That lowers the bar for exploitation considerably, and is part of why the agency moved quickly.

Ray’s problem is also the open-source ecosystem’s problem. Widely deployed infrastructure written and maintained by comparatively small teams becomes a single point of failure for everyone downstream, a dynamic laid bare by the Log4j crisis and its long tail of open-source funding questions.

AI has only raised the stakes, because the compute now sitting behind these frameworks is among the most valuable on any network.

Ray clusters have been a target before. Researchers at Oligo Security documented a campaign they called ShadowRay, tied to a separate and older Ray weakness, in which more than 230,000 internet-exposed servers were scanned and compromised systems were mined for cryptocurrency, credentials, and whole repositories of source code and models.

That earlier flaw is not the one CISA listed this week, but it is a preview of what exposed Ray infrastructure attracts, from cryptojacking that quietly hijacks hardware to outright data theft.

CISA lists the vulnerability’s known use in ransomware campaigns as “unknown”, so there is no confirmed extortion angle at this stage; the immediate risk is unauthorised code execution and everything that follows from it.

Even so, the pattern is a familiar one: a critical flaw, a patch available, exploitation confirmed, and a shrinking window before opportunistic attackers pile in, much as they did with an actively exploited Java zero-day years earlier.

For federal agencies the deadline is fixed at 20 August under CISA’s binding-directive framework, the catalogue first established by Binding Operational Directive 22-01 and now governed by the risk-based BOD 26-04.

Private-sector operators face no legal clock, but the government deadline is a reasonable proxy for how urgently everyone else should treat it.

The security-desk advice is the calmer version of the same order: find any Ray deployment on your network, confirm whether it is reachable from outside, restrict access to it, and move to 2.52.0 without waiting to learn whether you are already on someone’s list.

Get the TNW newsletter

Get the most important tech news in your inbox each week.