How to patch application vulnerabilities without upgrading

Summary 

• Most enterprise applications cannot be fixed simply by upgrading to the latest version of an impacted library.
• Lightwell delivers backported security fixes at your exact production library versions with cryptographically signed artifacts and SBOM included for compliance.
• Red Hat® Ansible® Automation Platform acts as the governed execution layer that turns Lightwell's validated patches into safe, auditable remediation at scale. 
• The same automation foundation extends beyond application libraries to your OS, virtual machines, and network infrastructure using tools you already own.

Introduction 

A scanner found a vulnerability in your OS or application. The CVE is confirmed, and a patch has been released upstream. Then you discover the ticket that's been sitting open and unresolved for 3 months. 

If this sounds familiar, you're not alone. The average mean time to remediation (MTTR) for complex enterprise applications in 2025 was 5 months and 10 days (Qualys Enterprise Patch & Remediation Benchmark 2026). 45% of discovered vulnerabilities in large enterprises remain unpatched after 12 months, with more than 17% classified as high or critical severity (Edgescan 2025 Vulnerability Statistics Report). Finally, 95% of component downloads have a fix available (Sonatype's 2026 State of the Software Supply Chain Report). 

Which begs the question: Why is patching so slow?  

Investments in vulnerability scanners and AI-assisted discovery tools make identifying exposures easier than ever. The top challenge is no longer spotting vulnerabilities—it is closing the window between discovering a flaw and safely remediating it in production. Unfortunately, solving this problem is rarely as simple as telling teams to "just upgrade."

Why you can't always upgrade to fix a CVE

Applications are built, tested, and certified against specific library versions. Upgrading those versions can introduce breaking changes in production. In addition, when patching software, it's rarely as simple as upgrading one thing. Upgrading one library often requires configuration changes across multiple dependent services, requiring end-to-end verification. Regulated industries often must undergo expensive recertification or rigid change control processes before deploying major updates. When an upgrade requires a complete application rebuild, the process can stretch from days into months. 

To workaround these delays, teams often create their own private fork. While a fork may address the initial vulnerability, it creates an ongoing maintenance issue with every change that follows requiring a reapplication of the patch. 

What is Lightwell?

Frontier AI models are discovering vulnerabilities faster than ever. In response, highly regulated industries—such as financial services and healthcare—are shifting resources to accelerate their patching lifecycles.

To address this gap, Red Hat and IBM released Lightwell, a joint initiative designed to shrink the application vulnerability-to-exploit window.  Lightwell provides signed, backported security fixes (fixes applied to older supported versions) for eligible third-party open source dependencies, so you can patch your applications at their exact pinned production versions without forcing an upgrade. 

Backed by human engineers, Lightwell can help you execute surgical fixes on the exact stable versions that you run in production, eliminating the need to upgrade only to the latest version and, potentially, break production systems. The benefits of Lightwell include: 

• Enterprise remediation: For eligible application-layer dependencies, Red Hat and IBM engineers validate vulnerabilities and deliver signed, backported fixes to your pinned production versions—so your team isn't building and maintaining private patches alone. 
• Clearinghouse intelligence: Lightwell Clearinghouse Premier members can use anonymized, cross-institution vulnerability context to help prioritize remediation and get guidance when upgrading isn't the safest path.
• Upstream contribution: Remediated fixes are contributed back to upstream communities after applicable embargo windows, helping to avoid the long-term maintenance burden of private forks.
• Compliance artifacts: signed remediation packages with provenance and supporting documentation including software bills of material (SBOMs) and Common Security Advisory Framework (CSAF)/Vulnerability Exploitability eXchange (VEX) (for OpenShift Virtualization) where applicable.

How to automate application patching at scale 

With Lightwell providing backported fixes, automation orchestrates all of the independent functions needed to get a patch fully integrated into a secure version of an application:

• Identifying impacted systems 
• Creating and updating service tickets with additional context such as patch severity 
• Running tests to validate patch
• Prioritization and routing of remediation 
• Verification of success
• Snapshot and reboot of systems
• Rollback of patch (upon failure)
• Audit report generation 

Here is an example of an automated remediation workflow using Ansible Automation Platform's automation orchestrator. In this workflow, AI is assisting with routing decisions for patches based on risk, but approval steps have been added to ensure human oversight:  

Automated remediation workflow with Ansible Automation Platform, Lightwell, and CI/CD tooling. 

Benefits of closing the patch-to-production window

Lightwell, automation, and your existing CI/CD tools complement each other. Lightwell provides backported fixes for exact application library versions, your existing CI/CD tools rebuild the application, and Ansible Automation Platform serves as the governed execution layer, turning Lightwell artifacts into policy-gated, auditable production changes.

Combining Lightwell with Ansible Automation Platform allows organizations to resolve competing priorities between SecOps (pushing for rapid patching cycles) and ITOps (protecting production stability). The result: improved MTTR, reduced operational risk, and an audit-ready environment.

Responding with automation in the AI-threat landscape

AI-related threats can be found across all of IT, not just vulnerable applications. While establishing resilient infrastructure is getting more complex, automation proactively protects organizations, regardless of the latest threat that appears on the horizon. 

Here are some practical principles that organizations can follow to build stronger defenses: 

• Assess your patching maturity. Many organizations have yet to master basic automated patching (pre-check → snapshot → patch → reboot → post-check → rollback on failure) I outlined in the Lightwell workflow above. Building this automated foundation makes it easier to repeat the process across your network, your OS, virtual machines, cloud infrastructure, and more. 
• Mitigate what you can't predict. You can use automation to shrink the blast radius of threats without taking a service down completely. You can automate network micro-segmentation, apply firewall rules, rotate exposed credentials, and contain the exposure to the affected systems.
• Adopt event-driven remediation. Separate the signal from the noise produced by your vulnerability scanners and observability tools. Known, predictable, or low risk events can be resolved immediately and proactively, reducing alert fatigue and freeing up time for teams to focus on the complex or novel situations. 
• Orchestrate your IT investments. You may have tools that handle basic patching, but what about the infrastructure they don't touch? Connect SIEM and SOAR investments with ITSM so detection, response, validation, and auditing occur in a single continuous stream without requiring new tool investments.

Automation allows you to take these practical steps today without investing in new tools, so you can optimize these solutions for a stronger security posture. 

Additional resources and next steps

• Read AI threats move fast. Your defenses should too.
• Learn more about how Lightwell helps enterprises remediate application-layer open source vulnerabilities.
• Watch our video to see how apply to patches on both RHEL and Windows in one workflow
• Talk to a Red Hatter about Lightwell and Ansible Automation Platform