CISA Flags Actively Exploited Ray Vulnerability Enabling Browser-Based RCE
Summary
CISA added Ray flaw CVE-2025-62593 to its KEV catalog after citing active exploitation. DNS rebinding through Firefox or Safari can enable RCE against vulnerable Ray environments; Ray 2.52.0 fixes the issue.
Key points
- CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities catalog, citing active exploitation, but did not disclose details of in-the-wild attacks.
- The Ray vulnerability can enable remote code execution through DNS rebinding involving Firefox or Safari.
- The issue primarily affects developers running Ray development or testing environments; a malicious website or advertisement may trigger an attack.
- Maintainers say the attack can also target network-adjacent Ray instances inside a private corporate network.
- Ray version 2.52.0 addresses the vulnerability.
- A BitSight report said RondoDox operators incorporated the flaw into their arsenal before its public disclosure; Oligo linked unpatched Ray instances to the ShadowRay 2.0 cryptocurrency-mining campaign.
- CISA recommended that Federal Civilian Executive Branch agencies apply fixes and mitigations by August 20, 2026.
Article Details
- Vulnerability Types
- Remote code execution
- DNS rebinding
- Severity
- Critical (CVSS 9.4)
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1189 · Drive-by CompromiseA victim who visits a malicious website or is served a malicious advertisement can trigger the browser-based DNS rebinding attack against Ray.T1210 · Exploitation of Remote ServicesThe article says the browser can act as a confused deputy to extend the attack to network-adjacent Ray instances inside a private corporate network.
CVE
People
Malware
Products
Mozilla FirefoxCISA has added CVE-2025-62593, a critical Ray flaw that can lead to remote code execution through DNS rebinding attacks in Firefox and Safari, to its Known Exploited Vulnerabilities catalog due to active exploitation.RayCISA has added CVE-2025-62593, a critical Ray flaw that can lead to remote code execution through DNS rebinding attacks in Firefox and Safari, to its Known Exploited Vulnerabilities catalog due to active exploitation.SafariCISA has added CVE-2025-62593, a critical Ray flaw that can lead to remote code execution through DNS rebinding attacks in Firefox and Safari, to its Known Exploited Vulnerabilities catalog due to active exploitation.