The vulnerability identified as CVE-2026-35076 affects the MBS Single-A product. It involves the bac-scanresult method, which improperly validates user input controlling file names or paths. This flaw allows a remote attacker, who has user-level privileges, to delete arbitrary files on the local system. The CVSS 4.0 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability. There is no vendor advisory or patch information available at this time.

An attacker with user privileges can remotely delete arbitrary local files on the affected system, potentially disrupting system operations or causing data loss. The vulnerability impacts system integrity and availability but does not affect confidentiality. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges where possible and monitor for suspicious activity related to file deletions initiated via the bac-scanresult method.