we are fully patched, have no saml IDPs

It's also for SP, did you do everything after patching as well and in console all CVE are mitigated? Did you also fact check with your own SOC / security department and validate IOC’s?

I wonder if this was one of those that I saw probing, but not actively trying to exploit, the pitboss flaw.