The vulnerability identified as CVE-2026-32573 affects Nelio AB Testing plugin versions up to 8.2.7. It is classified as an improper control of code generation, commonly known as code injection. The CVSS v3.1 base score is 9.1, indicating critical severity, with attack vector being network, low attack complexity, requiring high privileges, no user interaction, and scope changed. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system. No official patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with high privileges can remotely inject and execute arbitrary code on systems running vulnerable versions of Nelio AB Testing. This can lead to full system compromise including data theft, data modification, and denial of service. The critical CVSS score reflects the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to the Nelio AB Testing plugin. Avoid exposing administrative interfaces to untrusted networks.