Summary
- CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalogue on 17 August after confirming active exploitation.
- The flaw affects Ray, an open-source framework widely used for distributed Python, AI, and machine-learning workloads.
- Compromise of exposed Ray environments can reach beyond application code into compute hosts, credentials, data, and connected cloud resources.
A critical vulnerability in the open-source Ray distributed computing framework is now being actively exploited, prompting the US Cybersecurity and Infrastructure Security Agency to add the flaw to its Known Exploited Vulnerabilities catalogue.
The issue, tracked as CVE-2025-62593, affects Ray deployments and can allow code injection under conditions described by CISA. The agency added the vulnerability to its catalogue on 17 August after confirming evidence of exploitation.
Ray is widely used to distribute Python and AI or machine-learning workloads across multiple processors and machines. That makes exposed management and development environments potentially valuable targets because a successful compromise can place an attacker inside compute infrastructure that may have access to data, credentials, cloud resources, or downstream workloads.
The vulnerability has been described as exploitable through a DNS-rebinding technique that can cause a browser to interact with a Ray service in a way the user did not intend. In practical terms, that can turn access to a developer’s browser session into a route for executing commands against a reachable Ray environment.
CISA’s addition of the flaw to the Known Exploited Vulnerabilities catalogue changes the risk assessment from theoretical exposure to confirmed attacker use. US federal civilian agencies are required to address catalogue entries by CISA’s specified deadline, but the exploitation evidence is equally relevant to private organisations running Ray in development, analytics, research, and AI infrastructure.
Compute control can become infrastructure control
The security consequence of a Ray compromise depends on how the cluster is deployed. A lightly isolated development environment may provide access only to temporary compute resources, while a production cluster can sit close to datasets, model artefacts, storage services, orchestration systems, and cloud identities.
That proximity is one reason vulnerabilities in AI and distributed-compute tooling have become more consequential. These platforms are designed to make it easy to submit work across large pools of compute, and the same capability can be abused if administrative interfaces are reachable by an attacker.
The risk can also be amplified by deployment assumptions. Frameworks built for trusted internal environments are sometimes exposed through cloud networking, remote development setups, or convenience configurations that were not designed to withstand hostile internet traffic.
CVE-2025-62593 therefore sits at the intersection of application security and infrastructure security. The vulnerable software is part of a development and compute stack, but successful exploitation can affect the underlying hosts and the workloads running on them.
For organisations using Ray to support AI pipelines, compromise can create additional questions around model and data integrity. An attacker with execution capability may be able to alter jobs, interfere with outputs, access secrets made available to workloads, or use compute capacity for unrelated malicious activity, depending on the permissions available to the cluster.
The active-exploitation designation does not establish how many organisations have been compromised, which threat actors are involved, or whether any particular sector is being targeted. CISA’s catalogue confirms exploitation, not the full scope or motive of the campaigns using the flaw.
It does, however, remove the argument that the vulnerability can be managed solely on the basis of theoretical likelihood. Ray environments that remain exposed now sit behind a flaw with demonstrated attacker value, and the speed with which distributed-compute platforms are being adopted means their management interfaces are increasingly part of the enterprise attack surface rather than specialist development infrastructure.
