Agencies need help with patch management, GAO says