CISA Adds Ray CVE-2025-62593 to KEV Catalog After Pre-Disclosure Exploitation by RondoDox

The vulnerability stems from Ray's decision to omit authentication on critical endpoints, enabling remote code execution when a developer running a local instance visits a malicious site or ad. Attackers chain a User-Agent bypass with DNS rebinding to execute arbitrary shell commands. This affects development and testing environments primarily but can be pivoted through the browser to reach internal corporate Ray clusters.

BitSight telemetry from March 2026 shows RondoDox operators integrated a public PoC two days before the November 26 2025 disclosure. Separate Oligo reporting documents ShadowRay 2.0 campaigns repurposing unpatched GPU-equipped Ray nodes for cryptocurrency mining. Both incidents predate CISA's KEV entry and occurred without any official attribution to state actors.

Ray 2.52.0 patches the fetch bypass. Federal Civilian Executive Branch agencies must remediate by August 20 2026. The pattern of unauthenticated endpoints in AI frameworks mirrors prior incidents in Jupyter and MLflow where developer workstations became initial access vectors for lateral movement.

Procurement records and GitHub telemetry indicate thousands of exposed Ray instances remain reachable from the public internet. Continued monitoring of port 8265 and 10001 traffic will reveal whether patching velocity matches the mandated deadline.