Fortinet said many of its customers still have not updated to fix CVE-2022-40684, which has been under active attack for two weeks.