Snyk · CVE-2026-21847Severity: critical
Deserialization of untrusted data in jackson-databind
Vulnerable version 2.15.2 resolved in 6 services. Fixed in 2.15.4. Exploitable via the public ingest API.
Security Remediation
Finding vulnerabilities was never the hard part.Fixing them is.
Security backlogs grow because remediation competes with the roadmap.
Cosmos turns scanner findings into fixes. It triages each alert for reachability, patches the vulnerable path with full codebase context, runs the change through the review fleet, and opens an audit-ready PR. Your engineers approve instead of patch.
cosmos / security-remediationQueue · 1 of 14
Triaged · reachable path confirmed in 2 of 6 services
Patched · dependency bumped · breaking change fixed
Review fleet · correctness and security passes clean
GitHub · pull request #5203cosmos/cve-2026-21847-jackson
Upgrade jackson-databind and fix serializer regression
- CI · 27 checks passed
- Deep Code Review · approved
- Audit trail · finding to fix, fully logged
Ready to merge · 13 findings remaining
Meet Cosmos
A fix behind every finding.
Connect your scanners and Cosmos works the queue: triage, reachability, patch, review, merge. Findings stop aging in a dashboard and start closing as merged code.
What our customers are seeing
Hours
From CVE alert to a reviewed fix PR
79%
Agent-written fixes shipped without edits
74 days
Industry median fix time Cosmos replaces
100%
Of fixes reviewed, logged, and auditable
A fleet of experts takes ownership from alert to merged fix.
Cosmos orchestrates the whole path. Finding Intake dedupes the queue, Reachability Triage separates real exposure from noise, the Remediation Author patches and repairs the build, and the review fleet checks every fix before a human approves the merge. Every loop shares memory.
Remediation lifecycleone finding, end to end
Detect
Finding Intake
Ingests findings from your scanners, dedupes them, and maps each CVE to the repos and services it touches.
Triage
Reachability Triage
Confirms whether the vulnerable path is reachable in your code, then prioritizes by blast radius instead of CVSS alone.
Remediation
Remediation Author
Patches the vulnerable path or upgrades the dependency, runs the tests, and fixes the breaking changes it causes.
Review · Approval
Review Fleet
Correctness and security passes from the code review experts on every fix before it reaches a human.
Human
Approves the fix and merges. Every step from finding to merge is logged for audit.
Fix merged · audit logged
Remediation Memory
Captures safe upgrade paths · Learns your stack · Shared with Code Review
Fig 1 · Remediation fleet
Built to fix, not just find
A security finding isn’t fixed until the PR is merged.
Another scanner makes the queue longer. Cosmos makes it shorter. The output of every finding is a tested, reviewed PR, not a ticket assigned to whoever is least behind.
Scanning alone
Built to find
- Findings pile up faster than teams can patch
- CVSS severity without reachability context
- Fix time measured in quarters
Cosmos remediation
Built to fix
- Every finding gets a fix attempt, automatically
- Reachability checked in your actual code
- Fix time measured in hours
- Finding to merge, fully logged for audit
From one CVE to fleet-wide hardening.
The same lifecycle handles a single critical finding and a systematic hardening pass. Define the policy once and the fleet applies it wherever the code matches.
Dependencies
Vulnerable dependencies
CVE-flagged packages upgraded across every affected repo, with the breaking changes fixed instead of left in a draft PR nobody merges.
Trigger · scanner finding
First-party code
Flaws in your own code
SAST findings like injection paths, unsafe deserialization, and authz gaps patched with the conventions of the surrounding code.
Trigger · SAST alert
Hardening
Hardening at scale
One policy decision, applied everywhere: rotate a pattern, retire an unsafe API, or enforce a secure default across hundreds of repos.
Trigger · policy change
Snyk
Semgrep
GitHub
GitLabGDPR · CCPA · HIPAAHighly customizable to your security posture.
Talk to Cosmos Advisor to set the rules of engagement: which severities auto-remediate, which need sign-off, which repos are in scope, and what your change windows allow. Keep your scanners and your approval chain.
SAST and SCA tools connect via MCP, and audit logs and SIEM come out of the box.