Home · Wiki · Incidents & Campaigns

type: incident · created: 2026-08-18 · updated: 2026-08-18 · tags: [incident, kev, advisory, ray, ai-ml, government, sector-government] · confidence: high · affected_sectors: [government, technology] · au_impact: true

CISA Adds Ray-Project Ray Code Injection Flaw to Known Exploited Vulnerabilities

Source: CISA
Date: 2026-08-17
Reliability: Tier 1/4 — Official / First-party
Entity: CISA KEV catalogue / Ray-Project Ray

Summary

CISA added CVE-2025-62593, a code-injection vulnerability in Ray-Project Ray, to its Known Exploited Vulnerabilities (KEV) catalogue on 2026-08-17 with a remediation due date of 2026-08-20, signalling confirmed exploitation in the wild. Ray is widely used for AI/ML orchestration and distributed workloads.

Key Facts

CVE-2025-62593 — Ray code injection; added to KEV 17 August 2026
Remediation due 20 August 2026
Continues a week of KEV activity (Cisco ASA/FTD, Windows WinSock, Metabase)
Reinforces the two-week BOD 26-04 federal patch directive

Sector

Government — Official KEV/advisory action by CISA.

Source

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

Reliability

Tier 1 — Official government source.

Date

2026-08-17

Cve 2025 62593 Ray Code Injection — CVE detail page

Sources: raw/digests/Cyber-Digest-2026-08-18.md