CISA gives Ray users 3 days to patch

CISA added Ray’s actively exploited code-injection vulnerability, CVE-2025-62593, to its Known Exploited Vulnerabilities catalog on August 17 and gave federal civilian agencies until August 20 to mitigate it. The NVD record for the flaw says Ray versions before 2.52.0 can expose a developer to remote code execution through a browser-based attack, while CISA’s alert calls the class a significant federal-enterprise risk. Teams running Ray should inventory exposed dashboards, upgrade to 2.52.0 or later, and treat the three-day deadline as a useful private-sector SLA rather than a federal-only footnote—especially alongside the site’s agent security control-plane checklist.