ON 18 August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalogue. The entry concerns Ray‑Project’s Ray product and is labelled the Ray‑Project Ray Code Injection Vulnerability. According to the short description, Ray contains a code injection flaw that could allow remote code execution, with developers who use Ray as a development tool potentially exposed through Firefox and Safari.
The vulnerability is classified as a code injection issue that enables an attacker to execute arbitrary code on a compromised Ray instance. The NVD lists a CVSS score of 0.0, which reflects that no severity rating has been assigned in the public record. Exploitation relies on tricking a user into loading malicious content in Firefox or Safari, which then triggers the injection within Ray. No patch has been released and the patch status is recorded as unknown.
Because the CVE appears in the KEV catalogue, CISA confirms that active exploitation of CVE-2025-62593 has been observed in the wild. No ransomware‑linked campaign has been attributed to this vulnerability at present. The agency has established a remediation deadline of 21 August 2026 for Federal Civilian Executive Branch (FCEB) agencies to apply the necessary mitigations.
CISA’s required action states: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. This directive binds FCEB agencies; all other organisations should review their deployment of Ray and consider implementing any available mitigations.
For full details, refer to the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-62593 and the CISA KEV catalogue entry.