CISA said it has evidence of active exploitation for two out of six Expedition v Palo Alto Networks patched in October.