The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability impacting the Ray distributed computing framework to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion is based on evidence of active exploitation in the wild. The framework, which is Python-native and open-source, is widely used to scale artificial intelligence and machine learning workloads. While the advisory confirms active exploitation, specific technical details such as the CVE identifier, precise attack vector, and scope of impact remain limited in the initial reporting.

What should defenders do?

Update Ray to the latest patched version immediately. Monitor CISA and Ray project advisories for specific CVE details and patch releases. Restrict network exposure of Ray services where possible.

highVulnerability

CISA Adds Actively Exploited Ray Framework Vulnerability to KEV Catalog

Critical flaw poses browser-based RCE risk for AI/ML distributed computing systems

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

CISA Adds Actively Exploited Ray Framework Vulnerability to KEV Catalog

Key Takeaways

CISA has added a critical Ray framework vulnerability to its KEV catalog due to evidence of active exploitation.
The Ray distributed computing framework is widely used for scaling AI and machine learning workloads.
Organizations using Ray should prioritize updating to the latest patched version.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read