CISA is warning about ongoing exploitation of a 2008 bug in multiple versions of Excel.