The vulnerability identified as CVE-2026-35077 affects the MBS Single-A product. It arises from the ugw-delete-file method, which does not properly validate user input controlling file names or paths. This flaw enables a remote attacker who has user-level privileges to delete arbitrary files on the local system. The CVSS 4.0 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, no privileges required beyond user level, and no user interaction needed. The vulnerability does not involve confidentiality or integrity impacts but has a high impact on availability. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

An attacker with user privileges can remotely delete arbitrary local files on the affected system. This can lead to denial of service or disruption of normal operations by removing critical files. The vulnerability does not affect confidentiality or integrity but poses a significant availability risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges where possible to limit exposure. Monitor for updates from the vendor regarding patches or mitigations specific to this vulnerability.