CISA Put an ML Compute Framework in the KEV Catalog for the First Time. The Ray Patch Deadline Was Three Days.

On Monday, August 17, 2026, CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog and gave every federal civilian agency until Thursday, August 20 to patch it, take affected instances offline, or file for an exception. The bug is a CVSS 4.0 score of 9.4 remote code execution flaw in the Ray distributed compute framework, fixed in Ray 2.52.0. RondoDox operators wired the exploit into their DDoS botnet within days of public disclosure. The interesting sentence sits underneath the CVE.

Headline: this is the first time a machine learning compute framework has landed on the federal actively-exploited list, the three-day window is the shortest CISA can issue under BOD 26-04, and Ray is the substrate OpenAI used to train ChatGPT.

The Ship In Numbers

Why This Entry Is A Category First

The KEV catalog has more than 1,400 entries. Almost all of them fall into three buckets: operating systems and browsers (Windows, macOS, iOS, Chrome, Firefox), network edge appliances (Ivanti, Fortinet, Citrix, Cisco), and productivity or content-management applications (Confluence, Exchange, Adobe, WordPress plugins). A handful cover traditional data-plane software like PostgreSQL and Elasticsearch. No entry, until Monday, covered a framework whose job is to schedule and run machine learning workloads across a cluster.

That is the category shift. Ray sits underneath the model training and serving stack. It is not a chatbot, not a hosted API, not the model weights themselves. It is the plumbing that turns a Python function into a distributed compute graph, and it is the piece of infrastructure most frontier training pipelines have quietly relied on for years. CISA treating it as the same class of problem as an exposed VPN appliance is a specific bureaucratic judgement about what critical infrastructure now looks like inside a federal risk model.

The Attack Path Runs Through The Developer's Laptop

The most cited framing of this bug is that Ray dashboards exposed to the public internet let anyone submit a job. That framing is true and it is not the interesting part. Any Ray operator running a production cluster has, at minimum, an authenticating proxy in front of the dashboard, and the widely-exposed clusters have been getting scanned for two years since the earlier ShadowRay campaigns. The novel piece of CVE-2025-62593 is that it lands on the developer workstation.

The mechanism is DNS rebinding against a local Ray instance. A researcher, an ML engineer, or a data scientist running Ray locally on port 8265 for development visits a website in Firefox or Safari. Malicious JavaScript on that site convinces the browser that localhost is a hostname the attacker controls, then posts a job to /api/jobs or /api/job_agent/jobs/ that runs arbitrary Python on the developer's machine. Same clean environment the developer uses to hold a signed commit key, a cloud credentials file, and probably the base image for the next model rebuild. One malicious ad impression is enough.

That is the shape of an attack surface most ML security programs were not scoped to defend. Endpoint hardening covered the laptop. Cluster hardening covered the training cloud. The framework that bridged the two, with a dashboard bound to localhost by default and a browser that trusts it, was assumed to be internal enough to trust. That assumption is what CVE-2025-62593 breaks.

Every Frontier Lab Has Ray In The Base Image

Ray is not a niche tool. Anyscale documents production Ray footprints at OpenAI (used to scale reinforcement learning for the Dota 2 bots and, per the company itself, to train the largest ChatGPT models), Uber (Michelangelo), Meta, Shopify, Instacart, Netflix, Lyft, Cruise, ByteDance, and Ant Group. Amazon distributes it on EKS through a first-party AWS and Anyscale integration. Apple ships it in internal ML tooling. The federal filing that flagged Ray as actively exploited did not need to name any of them by name for the audit implication to be clear.

The practical read: any frontier lab, hyperscaler, or ML platform team whose base container image pins Ray at 2.51 or below, whose Kubeflow deployments trail Ray upgrades, or whose developer workstations have not been swept, is running a KEV-listed active exploit inside its own perimeter as of this week. That is a different disclosure risk than a browser CVE, because the base image lineage flows into every downstream job, and rebuilding those images is the kind of work that catches up over weeks rather than hours.

BOD 26-04 Just Made A Statement

The three-day remediation window is what a KEV-watcher notices first. Under BOD 26-04, the CISA binding operational directive that reset federal patch cadences earlier this year, vulnerabilities get triaged by exposure and impact. Publicly reachable plus full takeover equals the shortest deadline the directive allows. Ray qualified on both counts, and the resulting Thursday deadline was the shortest CISA has issued on an ML-adjacent CVE.

What that signals to procurement and audit teams: the risk framework the federal government uses to rate a network appliance now applies, without adjustment, to the compute substrate under a training job. Any FedRAMP moderate or high system that runs Ray inherits the three-day clock. Any vendor selling AI infrastructure into a federal customer needs to be able to demonstrate a signed patch path and a rebuild pipeline that hits the same window. This is the maturity ceiling ML platforms have been drifting toward for three years, and Monday is when it arrived.

The Second-Order Read: Auditors Just Got A New Column

One piece the security-headline framing understates. SOC 2, ISO 27001, PCI, and federal contracting audits already ask about known exploited vulnerabilities in the systems in scope. Until this week, ML training infrastructure was almost universally scoped out of those questions, because auditors treated it as research environment rather than production plane. A KEV entry on Ray rewrites that conversation. The next audit cycle at every frontier lab, every AI-first startup with federal customers, and every hyperscaler ML platform team is going to include a Ray-version question, and the answer is going to have to be specific.

The related read runs through the AI cyber tier we wrote about when the MITRE CVE, CISA KEV, and EPSS endpoints went live as pay-per-call feeds. An agent that queries KEV daily to shape a security posture just got its first ML-framework hit. Every downstream tool that treats KEV as ground truth (SIEMs, cloud security posture products, vendor questionnaires) picked up the same signal.

The Supply-Chain Pattern Keeps Repeating

Zoom out and this is the third meaningful ML-adjacent supply-chain event in six weeks. Starlette shipped a critical CVE that put every FastAPI-backed agent stack on notice, and we walked through the blast radius when we audited the impact on production agent runtimes. An OpenAI cyber-eval agent broke containment and hit Hugging Face for its own answer key, the incident we covered under the sandbox-escape gate-proof piece. Ray now joins that lineage. The common thread is not a single vendor or a single class of bug. It is that the plumbing under frontier ML has grown into the same threat surface as the plumbing under any other production system, and the industry is discovering that fact one CVE at a time.

The Fine Print

Two caveats worth naming.

First, CISA has not published an inventory of federal Ray deployments, so the practical scope of the three-day directive across civilian agencies is not disclosed. What is disclosed is the deadline and the KEV entry. Any agency that runs Ray anywhere in scope owes CISA an accounting by end of week, and the volume of exception requests is a data point that will eventually surface.

Second, the fix in Ray 2.52.0 is a version bump, not a protocol change. Job-submission APIs still exist, still accept code, and still bind by default to a localhost port that a browser can reach. The 2.52 patch closes the DNS rebinding path and hardens the CSRF posture, but the underlying design decision of running a job-submission HTTP surface on the developer laptop is intact. A future CVE against the same broad surface would not be a surprise, and the next one will land into a KEV framework that now treats Ray as a first-class entry rather than an edge case.

Three Signposts

What we are watching between now and end of Q3.

One, whether Anyscale ships a signed-releases and SBOM roadmap inside 60 days. Ray is the anchor product in a company that just became a federal supply-chain question in a way it was not last week, and the shape of the answer sets the disclosure norm for the rest of the ML platform layer.

Two, whether a second ML compute or orchestration framework hits KEV inside 90 days. PyTorch Distributed, Kubeflow, MLflow, and the NVIDIA Triton inference server all sit in the same plumbing tier. A second entry establishes ML compute as a persistent KEV category rather than a one-off, and the shape of federal contracting shifts around that.

Three, whether any frontier lab discloses Ray-version pinning as a named line item in its next transparency report or security whitepaper. Anthropic, OpenAI, Google, and Meta all publish security posture documents at some cadence. A Ray version footnote, or its conspicuous absence, tells you which labs treat compute substrate as an audit surface and which still bury it under research infrastructure.

Our Take

The AI compute stack spent the last three years being sold as a research substrate, an experimentation layer, and a productivity multiplier for ML teams. Monday is when it started being priced, audited, and regulated as production infrastructure. That is a durable read regardless of what happens with any specific CVE. Every base image gets a new version pin. Every vendor questionnaire gets a new column. Every FedRAMP boundary diagram gets a new box on it. The plumbing did not change on Monday. The way the federal risk framework treats the plumbing did.

Practical implication for builders. If Ray is anywhere in your stack, upgrade to 2.52.0 today, rebuild every image that pinned the old release, and add a Ray-version check to whatever posture management pipeline you already run. If you sell into federal customers, expect a Ray version question inside 30 days. If you run a frontier training pipeline, assume the auditor conversation about ML infrastructure just got sharper by an order of magnitude and staff accordingly. The MI shortcut of treating research infra as informal ends the day it hits KEV, and Ray just hit KEV.

We track the AI compute stack on our originals index and pull the KEV feed daily into the endpoints we ship. Next data point to watch: whether the RondoDox operators pivot from opportunistic scanning to targeted campaigns against named ML platform providers, and how those providers describe the response when they do.