Authentication bypass leading to remote code execution (CVSS 8.6), on CISA KEV since Oct 13 with an Oct 16 due date. Volexity says actor UTA0576 exploited it from Oct 3 against an appliance that was fully patched at the time (22.8R2.4): a welcome.cgi auth bypass via the X-DSCGI-PATH header plus a race in wu.cgi uploads, chained with a separate privilege escalation (dsinvoked/DSCache) that Ivanti has not yet fixed. Post-exploitation targeted AD credentials, LAPS passwords and BitLocker keys, with log tampering. The chain patches code in memory only, so Ivanti's Integrity Checker does not detect it; memory and network forensics are needed. Fixed (auth bypass/RCE) in 22.8R2.5 and 25.1.3.0. Hunt: high volumes of requests to /dana-na/auth/url_default/welcome.cgi where the URL path and X-DSCGI-PATH header mismatch; check /tmp/. Defused says its honeypots caught what it believes is this exploit on Oct 1 (unconfirmed by Ivanti).