CISA Warns of Critical Ray RCE Flaw Exploited in Active Attacks
Brief
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability in Ray, the open-source distributed computing framework, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming exploitation in the wild.
Tracked as CVE-2025-62593, the flaw affects Ray versions prior to 2.
- 0 and carries a CVSS 4. 0 score of 9.
- CISA added the issue to the KEV catalog on August 17, 2026, requiring U. S. federal civilian agencies to remediate it by August 20.
The agency’s listing states that the vulnerability could allow remote code execution and specifically warns that developers using Ray as a development tool may be exposed when using Firefox or Safari.
Critical Ray RCE Flaw Exploited
The vulnerability is rooted in Ray’s handling of HTTP API endpoints, including /api/jobs and /api/job_agent/jobs/ .