Security Advisories

Ray Secure Innovations Security Advisories

Official Security Advisory Repository for Ray Secure Innovations Products and Services

Overview

Ray Secure Innovations publishes security advisories to help customers, partners, security researchers, and the broader cybersecurity community understand security vulnerabilities affecting Ray products and services.

This page serves as the official public repository for Ray Secure Innovations security advisories, including vulnerabilities affecting Ray networking devices, security, cloud management, firmware, virtual appliance, API, and other Ray products.

Ray Secure Innovations develops enterprise networking and cybersecurity technologies, including:

• SD-WAN
• Firewalls
• VPN solutions
• Secure Gateways
• HSIA
• Cloud Controller
• Embedded Linux appliances
• APIs
• Networking software
• Firmware
• Virtual appliances
• Future networking and security products

Purpose

The purpose of this Security Advisories page is to:

• Provide a central public source for Ray security advisories.
• Help customers identify affected products and versions.
• Provide remediation, mitigation, workaround, and upgrade guidance.
• Communicate CVE identifiers, CVSS scores, CWE classifications, and severity ratings where applicable.
• Support coordinated vulnerability disclosure.
• Support Ray Secure Innovations’ vulnerability management and CVE publication process.
• Provide a mature public disclosure source suitable for Ray’s current or future role as a CVE Numbering Authority.

How Security Advisories Are Published

Ray Secure Innovations publishes a security advisory when a validated vulnerability affects Ray products or services and customer awareness or action is required.

Advisories may be published for vulnerabilities affecting:

• Ray-developed software or firmware.
• Ray-managed cloud services.
• Ray Cloud Management Platform.
• Ray SD-WAN, firewall, VPN, HSIA and secure gateway products.
• Ray APIs and web management interfaces.
• Ray virtual appliances and containerized services.
• Ray-maintained open-source components.
• Third-party or open-source components when they affect Ray products and require customer action.

Ray may publish an advisory when:

1. A vulnerability has been validated.
2. Affected products and versions have been identified.
3. Severity and customer impact have been assessed.
4. A fix, patch, upgrade, mitigation, or workaround is available.
5. CVE assignment has been completed or requested, where applicable.
6. Coordinated disclosure requirements have been considered.
7. Customer guidance is ready for publication.

Ray may also publish an advisory before a complete fix is available when customer protection requires early notification, including cases involving active exploitation, public exploit availability, or significant customer risk.

Advisory Numbering Scheme

Ray Secure Innovations security advisories use the following numbering format:

Where:

Example

This represents the first Ray security advisory published in 2026.

Relationship Between Advisory IDs and CVEs

A Ray advisory ID and a CVE ID serve different purposes.

One Ray advisory may reference:

• One CVE.
• Multiple CVEs.
• No CVE, if the issue does not meet CVE eligibility criteria.
• A third-party CVE, if the vulnerability originates in a dependency or upstream component.

CNA Status Wording

Severity Classification

Ray Secure Innovations uses severity ratings to help customers prioritize remediation.

Severity is generally based on CVSS scoring, product-specific risk, deployment exposure, exploitability, impact, and whether exploitation is known or likely.

CVSS Explanation

Ray Secure Innovations may publish CVSS v3.1 and/or CVSS v4.0 scoring information in security advisories.

CVSS helps communicate vulnerability severity using standard metrics such as:

• Attack Vector
• Attack Complexity
• Privileges Required
• User Interaction
• Impact to Confidentiality
• Impact to Integrity
• Impact to Availability
• Exploit maturity or threat context, where applicable
• Environmental or deployment-specific considerations, where applicable

A Ray advisory may include:

Or:

Where appropriate, Ray may include both CVSS v3.1 and CVSS v4.0 to support customer vulnerability management workflows.

Supported Products

Security advisories generally apply to supported Ray products and versions.

Ray Secure Innovations prioritizes vulnerability remediation for products that are within their supported lifecycle.

Product Areas Covered

End-of-Life Products

Products that have reached end-of-life or end-of-support may not receive security updates. Ray may still publish advisories for end-of-life products when there is significant customer risk, active exploitation, or impact to supported products.

Advisory Archive

The table below shows the recommended structure for Ray security advisories.

Latest Security Advisories

Advisory Status Definitions

Search and Filter Recommendations

Ray should implement search and filtering capabilities to help customers quickly identify relevant advisories.

Recommended filters:

Recommended Search Fields

The advisories page should support keyword search across:

• Advisory title
• Advisory ID
• CVE ID
• Product name
• Affected version
• Fixed version
• CVSS vector
• CWE
• Vulnerability summary
• Technical description
• Mitigation guidance
• References

RSS and Email Notifications

Ray Secure Innovations recommends providing customer notification options for new and updated security advisories.

Recommended Notification Channels

Email Notification Categories

Customers should be able to subscribe to:

• All Ray security advisories.
• Critical and High advisories only.
• Product-specific advisories.
• Cloud platform advisories.
• Firmware advisories.
• Virtual appliance advisories.
• API and developer platform advisories.

Security Contact

To report a suspected vulnerability or ask a question about a Ray security advisory, contact Ray Product Security.

Responsible Disclosure Reference

Ray Secure Innovations encourages responsible security research and coordinated vulnerability disclosure.

Researchers should review the Ray Vulnerability Disclosure Policy before submitting reports.

Vulnerability Disclosure Policy:

https://www.ray.life/security/disclosure-policy

Reports should include affected product, affected version, technical description, reproduction steps, proof of concept, impact, and disclosure status.

Ray aims to acknowledge vulnerability reports within 3 business days and provide updates during active investigation where practical.

Advisory Publication Lifecycle

Vulnerability Remediation Process

Customer Notification Process Recommendations

Ray should maintain a documented customer notification process for security advisories.

Recommended Process

1. Classify advisory severity.
2. Identify affected customers, products, versions, and deployment models.
3. Prepare customer-facing advisory content.
4. Prepare support scripts and escalation guidance.
5. Notify registered security contacts.
6. Publish advisory on the public advisory page.
7. Publish or update release notes.
8. Notify partners, resellers, and managed service providers where appropriate.
9. Track customer questions, upgrade adoption, and advisory updates.

Notification Priority

Version Management Recommendations

Ray should maintain clear affected-version and fixed-version information in every advisory.

Recommended Version Rules

• Use exact affected version ranges where possible.
• Avoid ambiguous wording such as “all older versions” unless technically accurate.
• Clearly state fixed versions.
• Identify whether cloud services have already been remediated.
• Identify whether customer-managed products require manual upgrade.
• Identify whether firmware, VM image, package, or container image updates are required.
• Document whether a workaround fully or partially mitigates the issue.
• Track superseded fixes and advisory revisions.

Example Version Format

Archived Advisories Recommendations

Ray should maintain older advisories in a searchable archive.

Archive Rules

• Do not delete old advisories unless legally required.
• Mark superseded advisories clearly.
• Preserve original publication date and revision history.
• Add banners for advisories affecting end-of-life products.
• Keep advisory URLs stable.
• Maintain redirects if advisory URLs change.
• Ensure advisories remain indexable by search engines and vulnerability databases.
• Support machine-readable feeds where possible.

Archive Status Labels

Advisory Update Policy

Ray may update published advisories when new information becomes available.

Advisory updates may include:

• Newly affected products or versions.
• Additional fixed versions.
• Updated CVSS score or vector.
• Updated CWE classification.
• New exploitation information.
• Additional mitigation guidance.
• Updated upgrade instructions.
• Reporter credit updates.
• Reference updates.
• Clarifications or corrections.
• Revision history updates.

Advisory Revision Rules

Each advisory should include a revision history table.

Reusable Security Advisory Template

Use this template for each Ray security advisory.

Advisory Title

Example:

Advisory Metadata

Affected Products

Vulnerability Summary

A critical authentication validation vulnerability in Ray Cloud Controller and related management services could allow an unauthenticated remote attacker to bypass authentication under specific conditions and gain unauthorized access to administrative management functions.

Successful exploitation could allow an attacker to view or modify device configuration, access limited tenant metadata, or perform unauthorized management actions depending on the affected deployment and product configuration.

Technical Description

Incomplete validation of authentication state during certain API request flows used by the management interface

Include:

• Affected component.
• Vulnerability class.
• Required privileges.
• Required network access.
• Required user interaction.
• Affected configuration.
• Security boundary affected.
• Conditions required for exploitation.
• Whether the vulnerability affects default deployments.

Avoid publishing exploit code or unnecessary weaponized details.

Impact

Successful exploitation could allow unauthorized access to management functions, configuration data, or tenant metadata depending on deployment configuration and exposed interfaces.

Potential impact examples:

• Unauthorized access to configuration data.
• Privilege escalation.
• Management plane compromise.
• Device configuration modification.
• Remote code execution.
• Security policy bypass.
• Service disruption.
• Tenant isolation failure.
• Sensitive information disclosure.

Attack Vector

Exploitation Status

State whether Ray is aware of exploitation.

Recommended wording:

Or:

Mitigation

Ray will provide temporary mitigation guidance if available.

Examples:

• Restrict management interface access to trusted networks.
• Disable affected feature temporarily.
• Apply access control rules.
• Rotate affected credentials.
• Enforce multi-factor authentication.
• Block vulnerable endpoint at gateway or firewall.
• Disable external exposure of affected API.
• Apply recommended Nebula policy changes.

Resolution

Ray will provide fixed version and recommended customer action.

Example:

Upgrade Instructions

Add product-specific upgrade instructions or link to release documentation.

Recommended structure:

1. Review affected versions.
2. Confirm backup of current configuration.
3. Download fixed version from official Ray portal.
4. Validate image checksum or signature.
5. Apply update during approved maintenance window.
6. Reboot appliance if required.
7. Confirm fixed version after upgrade.
8. Review logs for errors.
9. Contact Ray Support if upgrade fails.

Workarounds

Ray will add workarounds if available.

If no workaround is available:

Detection Guidance

Ray will add logs, commands, indicators, or methods customers can use to identify exposure or exploitation.

Examples:

• Review authentication logs.
• Review API access logs.
• Review management plane access logs.
• Check for unexpected configuration changes.
• Verify administrative user activity.
• Review cloud audit logs.
• Review firmware upgrade logs.
• Search for suspicious requests to affected endpoints.

Indicators of Compromise

Ray Secure Innovations will provide IOCs if found with any vulnerabilities.

If no IOCs are known:

Credits

Credit the researcher if applicable and approved.

Example:

If no public credit:

Revision History

FAQ

What is a Ray security advisory?

A Ray security advisory is an official public notice describing a validated security vulnerability or security issue affecting Ray products or services.

Does every Ray advisory have a CVE ID?

No. Some advisories may not receive a CVE ID if the issue does not meet CVE eligibility criteria, is a hardening recommendation, affects only unsupported products, or is already covered by another CVE.

Can one advisory contain multiple CVEs?

Yes. If multiple related vulnerabilities affect the same product, component, release, or remediation package, Ray may publish them in a single advisory.

How should customers prioritize advisories?

Customers should prioritize based on severity, CVSS score, product exposure, deployment model, exploitability, available mitigations, and whether exploitation is known.

What should customers do when a product is listed as affected?

Customers should review the affected version range, apply the fixed version or mitigation, review detection guidance, and contact Ray Support if assistance is required.

Are cloud services fixed automatically?

For Ray-managed cloud services, Ray may deploy fixes directly. Customer action may still be required for connected appliances, agents, APIs, integrations, or configuration changes.

How are researchers credited?

Ray may credit researchers who responsibly report validated vulnerabilities and follow Ray’s Vulnerability Disclosure Policy, subject to legal, privacy, safety, and coordination requirements.

Where should vulnerabilities be reported?

Vulnerabilities should be reported to Ray Product Security at:

Glossary