The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to patch a critical vulnerability in the open-source Ray framework within three days. The flaw, identified as CVE-2025-62593, is actively being exploited and carries a CVSS v4 score of 9.4, indicating a severe risk of remote code execution (RCE).
First disclosed in November 2025, the vulnerability affects Ray, a widely used framework for scaling Python and machine-learning workloads. The exploit leverages a weakness in how vulnerable Ray versions attempt to block browser requests. Specifically, Ray checks the User-Agent header for "Mozilla" to identify and block browser traffic. However, browsers like Firefox and Safari allow the Fetch API to modify this header, enabling attackers to bypass the check.
An attacker can exploit this by luring a developer running a vulnerable Ray instance to a malicious website or through a malvertising campaign. Using DNS rebinding, the attacker can then reach the local Ray service and execute arbitrary shell code on the developer's machine. This method can also be used to attack network-adjacent Ray instances within a private corporate network by using the developer's browser as a "confused deputy."
The vulnerability primarily impacts developers using Ray in development or testing environments. Ray's developers confirmed that falling victim to a phishing attack or malicious advertisement could lead to arbitrary code execution on a developer's machine.
Ray version 2.52.0 addresses this flaw. CISA's three-day remediation window for federal civilian executive branch agencies is a departure from the standard 14-day period, reflecting the agency's assessment of the vulnerability's elevated risk. While CISA did not explicitly state the reason for the urgency, its Binding Operational Directive 26-04 permits such expedited deadlines for particularly dangerous vulnerabilities. The "known to be used in ransomware campaigns" field for this vulnerability in CISA's catalog is marked as "unknown."
The Ray project, now managed by the Linux Foundation's PyTorch Foundation, originated at UC Berkeley and was commercialized by Anyscale. As of October 2025, Ray boasted over 237 million total downloads and 7 million weekly downloads, a nearly tenfold increase year-on-year. Industry estimates suggest Ray has 1 million monthly active users and is utilized by 60 percent of Fortune 500 companies.
A key factor contributing to the vulnerability is Ray's historical security model, which assumed clusters would operate within a trusted, isolated network, deferring authentication and access control to the surrounding infrastructure. This design led to a longstanding lack of authentication on critical endpoints. Ray 2.52.0 introduced optional token-based authentication as an additional defense, though it remains disabled by default. The project continues to recommend deploying clusters within controlled networks rather than relying solely on authentication as a substitute for network isolation.
