Enterprise artificial intelligence infrastructure, MLOps engineering environments, and cloud computing clusters are facing urgent security remediation requirements following an emergency directive from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Disclosed on August 18, 2026, CISA officially added a critical remote code execution vulnerability impacting the Ray AI distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog, citing confirmed in-the-wild exploitation by threat actors targeting enterprise GPU clusters.

Tracked as CVE-2025-62593 with a Critical CVSS severity score of 9.4 out of 10.0, the security defect allows unauthenticated adversaries to execute arbitrary operating system commands and take complete administrative control of Ray clusters via web browsers using sophisticated DNS rebinding attacks.

1. Understanding Ray’s Critical Role in Enterprise AI Infrastructure

Ray is an open-source, Python-native distributed computing architecture created by Anyscale that has become foundational to the modern artificial intelligence stack. With over 43,500 GitHub stars and widespread deployment across frontier AI labs, cloud hyperscalers, and Fortune 500 enterprises, Ray orchestrates distributed machine learning workloads, including large language model (LLM) pre-training, reinforcement learning from human feedback (RLHF), distributed hyperparameter tuning, and high-throughput model inference.

A typical production Ray deployment consists of a centralized Head Node coordinating dozens or hundreds of Worker Nodes equipped with high-density GPU computing resources (such as NVIDIA H100 and H200 accelerators). Due to its high computational value and access to proprietary enterprise training datasets, Ray infrastructure represents an exceptionally lucrative target for state-sponsored espionage actors and financially motivated cybercrime cartels.

2. Deconstructing the Attack Vector: Missing Authentication and Browser-Based DNS Rebinding

The root cause of CVE-2025-62593 lies in a longstanding architectural decision within the Ray development framework: by default, critical Ray Dashboard and job submission REST endpoints (specifically /api/jobs and /api/job_agent/jobs/) operate without native authentication mechanisms.

While previous security advisories focused on direct network exposure over public IP addresses, research conducted by Oligo Security and security researcher Jonathan Leitschuh revealed a far more pervasive attack vector: weaponizing modern web browsers (such as Mozilla Firefox and Apple Safari) as confused-deputy proxies via DNS Rebinding.

How the Browser-Based DNS Rebinding Exploit Operates:

• Step 1: Inadvertent User Interaction: An AI data scientist or software engineer working within an internal corporate network visits an attacker-controlled website or is served a malicious advertisement while browsing the Internet.
• Step 2: Rapid DNS Manipulation: The malicious web page runs background JavaScript that queries a custom domain configured with an ultra-short Time-to-Live (TTL). Once initial script files are loaded, the attacker’s DNS server rapidly alters its A-record response from the public IP address to the victim’s local loopback (127.0.0.1) or internal private subnet IP (e.g., 10.x.x.x or 192.168.x.x).
• Step 3: Same-Origin Policy (SOP) Bypass: Because the browser believes the request is still communicating with the original trusted origin, it permits cross-origin JavaScript requests to transmit HTTP POST payloads directly to local Ray Dashboard ports (such as port 8265).
• Step 4: Arbitrary Cluster Command Execution: The script submits a crafted job specification containing embedded shell commands to the unauthenticated /api/jobs endpoint. The Ray Head Node automatically schedules the job and executes the malicious payload across worker nodes with full operating system privileges.

3. In-The-Wild Threat Campaigns: ShadowRay 2.0 and GPU Hijacking

Threat telemetry from cybersecurity monitoring firms, including BitSight and Oligo, confirmed that cybercriminal syndicates have actively integrated CVE-2025-62593 into automated scanning botnets. Forensics identified two major campaign operations exploiting unpatched Ray deployments:

• ShadowRay 2.0 Cryptojacking Botnets: Threat actors systematically identify unauthenticated Ray clusters to deploy optimized Monero and Ethereum-compatible mining binaries tailored specifically for enterprise NVIDIA CUDA drivers, consuming massive datacenter compute power and causing substantial cloud infrastructure billing spikes.
• RondoDox DDoS Infrastructure: Adversaries weaponize compromised Ray worker nodes to install distributed denial-of-service (DDoS) daemons, utilizing high-bandwidth datacenter uplinks to launch volumetric network flooding campaigns against commercial targets.
• Proprietary Model & Data Exfiltration: Because Ray jobs have read/write access to mounted shared storage volumes, object stores (such as AWS S3 or Google Cloud Storage), and internal training databases, attackers can silently dump proprietary training weights, customer fine-tuning records, and internal API keys.

4. Comprehensive Defense and Hardening Guide for MLOps Teams

In response to active exploitation, CISA has issued an emergency compliance deadline of August 20, 2026, for Federal Civilian Executive Branch (FCEB) agencies to remediate exposed Ray infrastructure. Enterprise cloud security teams should immediately enforce a comprehensive defense-in-depth framework:

• Upgrade Ray to Version 2.52.0 or Newer: Deploy the latest patched releases of the Ray framework, which implement enhanced Origin header validations and fetch-metadata security controls designed to block unauthorized cross-origin browser interactions.
• Enforce Mandatory Reverse-Proxy Authentication: Never expose the Ray Dashboard or API ports directly to local networks or the Internet without an authentication layer. Wrap all Ray interfaces behind a zero-trust reverse proxy (such as NGINX, Traefik, or OAuth2-proxy) enforcing Mutual TLS (mTLS) or enterprise Single Sign-On (SSO).
• Deploy Network Isolation and Private Subnet Binding: Ensure Ray Head and Worker nodes bind strictly to dedicated private VPC subnets with ingress firewalls restricting access solely to verified MLOps deployment pipelines.
• Implement DNS Rebinding Protections: Configure corporate DNS resolvers and local endpoint firewalls to block external DNS queries that resolve to RFC 1918 private IP address ranges or loopback interfaces (127.0.0.0/8).
• Monitor GPU and Process Telemetry: Integrate specialized AI runtime detection tools to monitor anomalous container processes, unauthorized Python job submissions, and abnormal GPU memory allocation patterns across cluster nodes.

5. Strategic Implications for Enterprise AI Security

The weaponization of CVE-2025-62593 illustrates a critical evolution in the cybersecurity threat landscape: as artificial intelligence becomes central to enterprise operations, the specialized frameworks that power AI development must adhere to the same rigorous security standards as core enterprise applications. Securing machine learning infrastructure requires bridging the gap between data science productivity and uncompromising cybersecurity governance.

Source: The Hacker News / CISA Known Exploited Vulnerabilities Notice