CVE-2026-111036— Multiple vulnerabilities in Coupa’s Total Spend Management Platform

Quick assessment

Affected

Coupa Coupa Total Spend Management Platform

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Coupa 供应商门户 SaaS 平台中发现服务端请求伪造（SSRF）漏洞，该漏洞存在于“合同 > 模板”部分提供的文档转换功能中。漏洞成因在于使用 Aspose.Words for Java 库执行 DOCX 转 PDF 转换时，对外部资源引用的验证不足。拥有模板修改权限的已认证攻击者可上传特制的 DOCX 文档，其中包含指向外部资源的引用，从而诱使服务端应用程序访问由攻击者控制的 URL、内部网络资源或本地文件。成功利用该漏洞可能导致敏感信息泄露，例如配置文件、系统文件、凭据、环境变量以及内部服务的端点。

CVSS 8.4 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1041 · Exfiltration Over C2 Channel T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

Source: CVE Program / CVE List V5

Vulnerability Description

Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Coupa	Coupa Total Spend Management Platform	0 ~ 04/11/2024	-

II. Public POCs for CVE-2026-111036

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111036

请登录查看更多情报信息。

Other References for CVE-2026-111036 (1)

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

https://www.cve.org/CVERecord?id=CVE-2026-111036

Same Patch Batch · Coupa · 2026-11-04 · 4 CVEs total

CVE-2026-111038	7.3 HIGH	Multiple vulnerabilities in Coupa’s Total Spend Management Platform
CVE-2026-111040	5.1 MEDIUM	Multiple vulnerabilities in Coupa’s Total Spend Management Platform
CVE-2026-111037	5.1 MEDIUM	Multiple vulnerabilities in Coupa’s Total Spend Management Platform

IV. Related Vulnerabilities

Same product: Coupa Total Spend Management Platform

Same vendor: Coupa

Same weakness: CWE-918