CVE-2026-111040mediumCWE-80

CVE-2026-111040: medium-severity vulnerability in Coupa Total Spend Management Platform

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

Published

Follow this CVE+ Monitor Coupa Total Spend Management Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Coupa · Coupa Total Spend Management Platform
Related CVEs — Coupa Total Spend Management Platform

In the same product, most dangerous first.

CVE-2026-111037MEDIUMMultiple vulnerabilities in Coupa’s Total Spend Management PlatformEPSS 0.5%CVE-2026-111036HIGHMultiple vulnerabilities in Coupa’s Total Spend Management PlatformEPSS 0.4%CVE-2026-111038HIGHMultiple vulnerabilities in Coupa’s Total Spend Management PlatformEPSS 0.3%