If I'm not wrong, the CVV code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically brute-force a CVV code? Is an online attack possible?
Actually it was possible, at least for Visa cards. There was no per-card lockout across the entire network, so by hitting different payment processors (to prevent from reaching any brute force limit they might have) you could brute force a CVV2. I am not sure whether this is still possible, I would expect (and hope) that Visa implemented network-wide protections against this.
If I'm not wrong, the cvv code almost always follows a certain pattern
No you are wrong, it could be completely random, 3, 4 or n chars.
After some failed activity with the card(could be 3, 5 etc...), it will be disabled. Plus you need to provide captcha for every request.
Sounds like you are much into hack rather security. A hacker at first is a great security geek.