Case ray-cve-2025-62593-rondodox-kevAI supply chainWorldwide
Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV
Ray's defence against browser attacks only checked that the User-Agent began with Mozilla, so a malicious page plus DNS rebinding could execute code on a developer's cluster; Bitsight saw RondoDox exploiting it before the CVE was public.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 17, 2026
- Location
- Worldwide
- Target
- Developers running Ray AI compute clusters
- Severity
- High
- Triggered by
- RondoDox botnet operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- CVE-2025-62593
What happened
Ray's defence against browser attacks only checked that the User-Agent began with Mozilla, so a malicious page plus DNS rebinding could execute code on a developer's cluster; Bitsight saw RondoDox exploiting it before the CVE was public.
Impact: Remote code execution on unpatched Ray hosts reachable from a developer's browser; Bitsight judged the botnet's exploit ineffective as written but CISA confirmed exploitation
Who triggered it
Actor: RondoDox botnet operators
Attribution: Bitsight tracked RondoDox exploitation attempts from November 24, 2025; CISA later listed the CVE as actively exploited
Motive: Botnet growth for DDoS and XMRig cryptomining
How it happened
Attack vector: Cross-site request from a malicious website or ad combined with DNS rebinding against Ray versions before 2.52.0
Root cause: Insufficient User-Agent based CSRF protection in the Ray dashboard API
Timeline
- Bitsight first observes RondoDox exploiting the Ray flaw
- CVE-2025-62593 published; fixed in Ray 2.52.0
- CISA adds the CVE to the KEV catalog
Response
Upgrade to Ray 2.52.0 or later; federal agencies ordered to remediate
Current status: Patched
Sources (open in a new tab)
- CISA KEV cisa.gov
- Ray advisory github.com
- Bitsight bitsight.com
Cite this case
Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV. AI Threat Watch, case ray-cve-2025-62593-rondodox-kev, Aug 17, 2026. https://aithreat.io/cases/ray-cve-2025-62593-rondodox-kev/
Permanent link: https://aithreat.io/cases/ray-cve-2025-62593-rondodox-kev/