CISA adds Ray Project code injection flaw to exploited vulnerabilities catalog

By Atlas Watchline Staff · Regulatory · August 17, 2026

CISA added CVE-2025-62593, a Ray Project Ray code injection vulnerability, to its Known Exploited Vulnerabilities Catalog after finding evidence of active exploitation.

CISA added CVE-2025-62593 to its Known Exploited Vulnerabilities Catalog on Aug. 17 after saying it found evidence of active exploitation.

The agency described the issue as a Ray Project Ray code injection vulnerability. CISA said this type of flaw is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.

CISA uses the KEV Catalog to help organizations prioritize fixes for vulnerabilities already known to be in use by attackers. For federal civilian agencies, Binding Operational Directive 26-04 requires rapid remediation of high-risk vulnerabilities, including CVEs in CISA’s KEV Catalog on publicly exposed assets that can give attackers total control after exploitation.

CISA said the directive applies to Federal Civilian Executive Branch agencies. In some cases, the notice says those agencies must also check whether threat actors compromised a system before a patch was applied.

The alert did not name affected organizations or say how the exploitation was carried out. It did say the agency encourages all organizations to use risk-based vulnerability management and to prioritize remediation of vulnerabilities in the KEV Catalog.

CISA also said it will keep adding vulnerabilities that meet its criteria. Those nominations must include a CVE ID, evidence of exploitation and clear mitigation guidance, according to the notice. The agency said organizations can submit exploited vulnerabilities not already listed through its KEV Nomination Form.

Sources

• CISA Cybersecurity Advisories

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.