The Cybersecurity and Infrastructure Security Agency is forcing federal civilian agencies to patch a critical vulnerability in Ray, an open source framework for scaling Python and machine-learning tasks, within three days rather than the standard two weeks, according to a security alert. The agency says attackers are actively exploiting the flaw, which allows remote code execution through common web browsers. Ray is used by major technology firms including Amazon, Apple, and OpenAI to distribute computing workloads.
The vulnerability, designated CVE-2025-62593 and first revealed in November 2025, carries a severity score of 9.4 under CVSS v4. Affected versions of Ray attempt to stop browser requests by verifying whether the User-Agent header starts with "Mozilla," but Firefox and Safari permit scripts using the Fetch API to alter that header. A developer operating Ray can trigger the exploit merely by opening a malicious website or viewing a harmful advertisement in one of these browsers, with attackers then employing DNS rebinding to access the local Ray service. Ray version 2.52.0 resolves the issue. As of October 2025, Ray had accumulated more than 237 million total downloads and 7 million weekly downloads, reflecting nearly tenfold annual growth, while product analysis site NextSprints calculates the framework has 1 million monthly active users and is deployed by 60 percent of Fortune 500 companies.
"This vulnerability impacts developers running development/testing environments with Ray," the project's developers stated. "If they fall victim to a phishing attack, or are served a malicious ad, they can be exploited, and arbitrary shell code can be executed on their developer machine." The attack can also target network-adjacent Ray instances by using the browser as a confused deputy intermediary to reach Ray installations operating inside private corporate networks, according to the developers. CISA did not provide details about the urgency behind the compressed timeline and labeled the catalog's "known to be used in ransomware campaigns" field as "unknown," though Binding Operational Directive 26-04 permits the agency to enforce a three-day remediation period for vulnerabilities it deems especially dangerous.
The security advisory attributed the attack's feasibility to Ray's historical absence of authentication on critical endpoints. Ray's security architecture traditionally assumed clusters would operate within a trusted, isolated network, delegating authentication and access control to the surrounding infrastructure. Ray 2.52.0 introduced optional token-based authentication as an extra safeguard against unauthorized access, though it stays disabled by default, and the project continues to advise deploying clusters inside a controlled network instead of treating authentication as a replacement for isolation. Now managed by the Linux Foundation's PyTorch Foundation, the project originated at UC Berkeley and was commercialized through Anyscale, the startup Ray's developers launched in 2019.
The compressed remediation window and the exploit's reliance on everyday developer actions like browsing suggest CISA views this as a pathway for attackers to penetrate enterprise networks through the machines of engineers who routinely run Ray in development and testing environments. Organizations relying on Ray for production workloads face a choice between rapid patching cycles and deploying additional network segmentation to contain potential breaches until upgrades are complete. Federal agencies operating under the directive will need to balance speed with testing rigor, particularly if Ray is embedded in critical data pipelines or machine-learning infrastructure where hasty updates could introduce operational disruption.