Common Vulnerabilities Exposure (CVE) Autopilot

PROBLEM Patch deadlines are now audit items. Since 11 September 2026 the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities within 24 hours, and PCI DSS v4.0.1 (6.3.3) requires critical patches within one month. Yet the median time to fix a known-exploited vulnerability is 43 days (Verizon DBIR 2026). The slow part is manual: read the advisory, find the affected services, upgrade, discover the upgrade breaks the code, fix it, re-test, write the PR, then prove to an auditor it was done in time. In our sample monorepo, upgrading PyYAML and Jinja2 to their safe versions breaks 2 of 3 services (TypeError, ImportError). SOLUTION CVE Autopilot is an IBM Bob workflow that runs the whole remediation, not just a version bump: - Document understanding: Bob reads the advisory PDF and extracts package, CVE, severity, fix version and policy deadline, then cross-checks with pip-audit / npm audit. - Plan mode, then Agent mode: Bob proposes a remediation plan and waits for human approval before touching code. - Parallel subagents, one per affected service: baseline tests, upgrade, fix breaking changes, roll back failed attempts, retest until green. - Safety brake: if the only way to pass is to weaken security or edit a test, Bob stops and escalates to a human. - Evidence: Bob writes REMEDIATION.md, a CHANGELOG entry, the PR description, an SBOM before/after and an HTML patch-SLA dashboard (deadline vs actual time per CVE). A Streamlit app shows it all. TARGET USERS AND HOW THEY INTERACT Platform, DevOps and AppSec teams in regulated industries (payments, EU product makers, finance, health), and the compliance owners who must show patch SLAs were met. They open the repo in Bob IDE, pick the "CVE Autopilot" mode, paste one prompt, approve the plan, and review the resulting PR and dashboard. WHY IT IS CREATIVE AND UNIQUE Dependabot, Renovate and Snyk open version-bump PRs. CVE Autopilot repairs the code the upgrade breaks across services, shows each break and its fix with tests, re-scans to verify closure, checks CISA KEV for priority, and refuses unsafe fixes instead of forcing them. The new part: the output is not only a PR but audit-ready patch-SLA evidence (per-CVE deadline vs actual time, test proof, SBOM before/after) from one human-approved run. HOW IT SOLVES THE PROBLEM EFFECTIVELY AND EFFICIENTLY Real Bob runs on our sample monorepo: - Advisory run: 8 of 9 CVEs closed in 4 min 29 s by 3 parallel subagents; the 9th escalated (fix needs Python 3.10+). Critical PyYAML CVE fixed in 3 min 28 s against a 24 h policy window. - Day-2 live scan of 6 services: 29 of 33 advisories closed in 6 min 18 s, 4 escalated, one stopped by the safety brake. - SBOM: 16 known vulnerabilities before, 3 after (all escalated). No existing test changed; the unaffected auth service was left untouched. The 43-day median shows the problem size, not a like-for-like comparison. Autopilot helps meet deadlines; it does not by itself make anyone compliant.