Electoral Commission had internet-facing server with unpatched vuln