CVE-2026-41469

CVE-2026-41469 is a content security policy (CSP) enforcement failure in Beghelli Sicuro24 SicuroWeb that permits unrestricted loading of external JavaScript from attacker-controlled sources. When combined with existing template injection and sandbox escape flaws in the application, this vulnerability eliminates browser-level protections that would normally prevent malicious script execution, allowing attackers to inject arbitrary remote payloads into operator sessions. The vulnerability carries a CVSS score of 5.2 (Medium severity) with an adjacent network attack vector, low complexity, and no privilege requirements. Exploitation requires user interaction and results in limited confidentiality and integrity impacts without affecting availability. The FAUCET risk score of 32.0 out of 100 reflects moderate concern, though the extremely low EPSS score of 0.00026 indicates minimal real-world exploitation probability. There is no evidence of active exploitation in the wild, as the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on exploit tracking lists. No public exploit code is currently available, and community attention appears limited given the low EPSS percentile ranking. Organizations should prioritize patching based on their operational use of the affected Beghelli product and exposure to untrusted networks.