Beghelli Sicuro24 SicuroWeb contains a critical vulnerability (CVE-2026-41468) due to embedding the end-of-life AngularJS 1.5.2 framework. The vulnerability combines sandbox escape primitives with template injection to allow arbitrary JavaScript execution in operator browser sessions. Attackers can achieve session hijacking, DOM manipulation, and persistent browser compromise. Network-adjacent attackers can exploit this via MITM attacks in plaintext HTTP deployments without requiring user interaction. The vulnerability affects the security management application used for monitoring and control systems.