CISA orders agencies to patch the FortiWeb web application firewall within seven days after news of exploits emerges.