Ray AI Framework Added to CISA KEV — Patch by Aug 21

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog on August 18, 2026, confirming active exploitation of a code injection flaw in Ray — the open-source distributed computing framework used widely for ML training, model serving, and data pipelines.

The vulnerability enables remote code execution. Per CISA and the GitHub Security Advisory (GHSA-q279-jhrf-cc6v), the attack surface includes exposure through Firefox and Safari, meaning Ray installations with reachable web interfaces are in scope.

Under BOD 26-04, federal civilian agencies must remediate this entry by August 21, 2026 — three days from publication.

Who’s exposed

Ray is deployed broadly in ML production: distributed training clusters, Ray Serve inference pipelines, large-scale data preprocessing, AutoML platforms, and reinforcement learning infrastructure. Organizations running Ray on anything with a network-reachable surface — dashboards, job submission APIs, cluster UIs — are the immediate concern.

The default Ray dashboard runs on port 8265 and has shipped without authentication in many configurations. If your Ray instance is reachable beyond localhost — inside a corporate network, a cloud VPC, or exposed to the internet — that’s the attack surface at issue here.

Developer workstations running Ray locally, and cloud-based training jobs in isolated environments, have a lower but nonzero exposure depending on how the instance is bound.

What to do

Check the GitHub advisory for GHSA-q279-jhrf-cc6v for the patched version and the fix commit (70e7c72). CISA’s guidance when mitigations are unavailable: discontinue use of the product.

Concrete steps:

• Find Ray in your environment. Check container images, ML training platforms (Anyscale, KubeRay, self-managed clusters), and any CI/CD pipelines that invoke Ray for distributed processing.
• Patch to the fixed release per the GitHub advisory.
• If you can’t patch immediately: firewall port 8265 and any other exposed Ray ports to trusted networks. Do not leave the Ray dashboard bound to 0.0.0.0 or publicly reachable.
• Check for unintentional exposure. Review your network scan data or Shodan results for Ray dashboard fingerprints. Exposed, unauthenticated Ray dashboards have been a recurring cloud finding for years.

Priority call

This is a KEV — the “do we patch it” question is settled. The question is when.

Federal agencies: August 21. That’s the mandate.

Everyone else with Ray in network-reachable production: this week. KEV listing means active exploitation is confirmed, not theoretical. Opportunistic scanning against new KEV additions moves fast.

Isolated local dev installs with no network exposure: lower urgency, but schedule the update on your next regular cycle regardless.

Track this and all current CISA KEV entries at the 0dayNews KEV Tracker. For another recent AI/ML platform RCE, see MindsDB CVSS 10.0 unauthenticated RCE.