Ray Added to the KEV Catalog: Active Exploitation Targeting AI Development Environments

Vulnerability Enables Remote Code Execution

CISA has added Anyscale Ray vulnerability CVE-2025-62593 to its Known Exploited Vulnerabilities (KEV) catalog after receiving evidence of active exploitation. The vulnerability was added on August 17, 2026, while the remediation deadline for U.S. federal agencies was August 20, 2026.

The flaw affects versions earlier than 2.52.0 and may enable remote code execution against developers using Ray as a development tool. The vulnerability has a CVSS 3.1 score of 8.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The score indicates a remotely executable, unauthenticated attack that requires user interaction. The potential impact affects the confidentiality, integrity, and availability of the system.

The flaw is classified under CWE-94, which covers code injection, and CWE-352, associated with cross-site request forgery attacks.

How the Browser Can Expose Ray

According to the available technical description, the issue stems from insufficient protection against browser-originated requests. Ray treats the HTTP User-Agent header as trusted when it begins with the string Mozilla.

This check is inadequate. The Fetch specification allows the header to be modified, making it possible to bypass the check. The attack can be combined with DNS rebinding, which manipulates DNS resolution to make the browser communicate with a local service or an internal environment accessible from the developer’s machine.

The target therefore does not necessarily need to be a Ray instance exposed as an Internet service. It is enough for a developer to run a vulnerable environment and interact with attacker-controlled content or web pages. The available technical material does not provide further details about the exploit’s final operational step.

The user-interaction requirement reflected in the CVSS vector does not eliminate the risk for teams using Ray during development, testing, or model training. A compromised browser or malicious web page can provide an entry point into the local environment.

RondoDox Linked to the Exploitation

The activity has been attributed to the RondoDox botnet, described as a Mirai-inspired variant focused on compromising vulnerable edge devices.

According to an estimate attributed to BitSight, RondoDox has 174 distinct exploits. The specific link to CVE-2025-62593 is not supported by indicators of compromise, operational details, or independent confirmation of the attribution.

The key point remains the vulnerability’s inclusion in the KEV catalog: for CISA, it is no longer merely a theoretical risk. Organizations using Ray should consider the possibility that systems were compromised before the fix was installed.

CISA requires organizations to apply the mitigations provided by the vendor, comply with BOD 26-04 on risk-based update prioritization, and follow Forensics Triage requirements. If mitigations are unavailable, the guidance is to discontinue use of the product.

Organizations should also assess the Internet exposure of every asset and inspect systems before applying the patch. An update removes the vulnerability but does not eliminate any access that may have already been obtained.

Medusa Expands Its Use of KEV Vulnerabilities

A joint advisory from the FBI, CISA, and HHS updates the operational profile of the Medusa ransomware operation and adds two vulnerabilities to its list of exploited flaws:

• Fortra GoAnywhere MFT — CVE-2025-10035
• BeyondTrust Remote Support and Privileged Remote Access — CVE-2026-1731

Both vulnerabilities are listed in the CISA KEV catalog and have been used in ransomware campaigns. CVE-2025-10035 has a CVSS score of 10.0, while CVE-2026-1731 has a score of 9.8. They were added to KEV on September 29, 2025, and February 13, 2026, respectively, with federal deadlines of October 20, 2025, and February 16, 2026.

For both vulnerabilities, CISA recommends applying the vendor’s mitigations, following the applicable BOD 22-01 guidance for cloud services, or discontinuing use of the product when mitigations are unavailable.

Medusa also exploits:

• ScreenConnect — CVE-2024-1709, an authentication bypass;
• Fortinet EMS — CVE-2023-48788, an SQL injection vulnerability.

These vulnerabilities are also listed in KEV and have been used in ransomware campaigns. Their respective CVSS scores are 10.0 and 9.8. The federal deadlines were February 29, 2024, for CVE-2024-1709 and April 15, 2024, for CVE-2023-48788.

Over the past 90 days, additional vulnerabilities affecting the same vendors have also been added to the catalog: CVE-2025-68686 on July 27, 2026, and CVE-2026-25089 and CVE-2026-39808, both on July 16, 2026. This places Medusa’s activity within an ecosystem where remote-access, file-transfer, and infrastructure-management products remain high-priority targets.

More Than 500 Victims and Exploit Validation

Medusa is a ransomware-as-a-service operation active since June 2021. Since at least early 2023, it has used an affiliate model, with external operators responsible for gaining network access or conducting intrusions.

The group uses double extortion: encrypting data and threatening to publish stolen information. As of April 2026, authorities had linked the operation to more than 500 victims across critical infrastructure sectors, including healthcare, education, insurance, technology, legal services, and manufacturing.

Affiliates rely on phishing, stolen credentials, and unpatched publicly exposed applications. Initial access brokers may receive between $100 and $1 million, depending on the value of the access.

Medusa rapidly exploits newly disclosed vulnerabilities. In some cases, exploitation has been observed up to one week before public disclosure. However, there is no evidence that the group has directly developed zero-day or n-day exploits; early access may have come from criminal intermediaries or underground markets.

To verify whether an intrusion was successful, attackers use dynamic Interactsh URLs under the following domains:

oast[.]site
oast[.]pro
oast[.]fun

A subdomain may include the victim’s name and a random string, for example:

<victim-name>.<random-33-alphanumeric-characters>.oast.site

Requests to these domains may indicate an exploitation attempt or an attacker-initiated OOB check. Complete indicators are available in the advisory’s updated STIX files.

The operational priorities are clear: upgrade Ray to 2.52.0 or later, patch products targeted by Medusa, restrict remote-service exposure, segment networks, and search logs for requests to Interactsh domains. When a patch is applied after exposure, the asset should be treated as potentially compromised, followed by threat hunting and forensic analysis.