The vulnerability identified as CVE-2026-35076 affects MBS Single-A version V1_0_0_0. It is classified under CWE-73 (External Control of File Name or Path). The issue arises in the bac-scanresult method, which does not properly validate user-supplied input, enabling a remote attacker with user-level privileges to delete arbitrary files on the local system. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack or user interaction required, but privileges required and high impact on integrity and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with user privileges can remotely delete arbitrary files on the affected system, potentially leading to loss of critical data or disruption of service. The integrity and availability of the system are impacted. Since the attacker requires user privileges, exploitation is limited to scenarios where such access is already obtained or granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to file deletions. Avoid exposing the vulnerable service to untrusted networks if possible.