Critical Actively exploited

CVE-2025-62593

Ray-Project Ray Code Injection Vulnerability

What this means

Weakness: The application interprets attacker-supplied code, which then runs with its privileges.
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 20 August 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 17 August 2026
CVSS: —
EPSS: 16.89% probability of exploitation within 30 days · above 97% of all CVEs
Weakness: CWE-94 CWE-352
CISA due date: 20 August 2026 past due
Sources: cisa-kev

Our analysis Ray’s spoofable User-Agent guard becomes a browser-based RCE now on CISA’s KEV list

References

https://nvd.nist.gov/vuln/detail/CVE-2025-62593