The federal cybersecurity agency said some government departments had been actively exploited after failing to properly patch their systems.