It is possible. It can be done using native management API.
It can also be done calling /management-upload url using multipart. One part of multipart is patch zip file, and the second part is json holding request for CLI command /core-service=patching:patch(input-stream-index=0)
you can view this behavior by patching server using admin console and looking in web browsers console network