One link, your session: F-RevoCRM XSS has no fix but 8.0.4

JVN published an advisory dated 2026-08-17 for CVE-2026-71368, a cross-site scripting flaw in F-RevoCRM in which luring a logged-in user to a crafted URL causes arbitrary script to run in the CRM's origin ^[1][3]. The advisory rates it Medium, and the only remedy listed is updating to version 8.0.4 ^[1][2][9].

The affected range is F-RevoCRM 7.3.0 through 8.0.3 ^[2]. Because 8.0.4 is the single fixed version named, anyone still on the 7.3.x line has no backport to take and must cross a major version boundary to get the fix ^[16]. That is a migration project, not a patch window, and it is worth scoping before the first phishing wave rather than after.

What the public documents do not say matters as much as what they do. The exact XSS type is not confirmed, nor are the vulnerable parameters or endpoints, nor whether cookies can actually be retrieved, so the writeup declines to call this reflected XSS or a confirmed cookie theft ^[5]. Viewing, changing, or exporting customer, deal, and contact records is described as an inference; no actual damage is confirmed in public documents ^[12]. Take that at face value: you cannot write a precise WAF signature from this material, and you cannot tell an executive that records were read.

The parts that are asserted are enough to act on. An attacker can prepare the crafted URL or page without authenticating; what is required is user interaction plus a valid login session ^[4]. Delivery is by email, chat, or a website, and the source notes email is a possible vector rather than a confirmed one in this case ^[13]. Once the script runs, it can attempt CRM operations, read screen data, or take session information inside the user's session, and follow-on requests reach the server as legitimate sessions ^[3][14].

This is the part that defeats the usual detection posture. The CRM screen may look normal afterwards, and there may be no clear warning even if session information is stolen ^[6]. The activity comes from normal devices, normal IP addresses, and MFA-authenticated sessions, so authentication success tells you nothing ^[7]. JavaScript execution finishes inside the browser and is hard to see with EDR process telemetry alone ^[8]. No malware or threat group is associated with this entry ^[15].

Beyond the upgrade, the advisory's mitigations are the familiar containment set: log out of F-RevoCRM before visiting untrusted sites, keep the CRM and general browsing in separate browsers or isolated environments, block payload execution with output encoding, CSP, or WAF and proxy controls, and blunt follow-on abuse with session cookie protection and re-authentication for critical operations ^[9]. CSP is the one worth prioritising if 8.0.4 is weeks away, since it does not depend on knowing which parameter is vulnerable.

For hunting, the signals offered are transitions from external referrers into F-RevoCRM URLs with long or encoded parameters, abnormal referrers, browser traffic from the CRM screen to unknown domains, and unnatural read, update, export, or settings changes compressed into a short window in one session ^[10]. Pull F-RevoCRM audit logs covering login, record read, update and delete, export, API and management operations, alongside reverse proxy, WAF and application access logs; without TLS visibility, fall back to domain, SNI, traffic volume and timing ^[11].

Grade any suspected case on the ladder the source uses: received the URL but did not click, confirmed click or page visit, then confirmed payload execution or external callback ^[17].