CISA is giving FCEB agencies a tight deadline to patch as researchers discover evidence of abuse.