The vulnerability CVE-2026-35077 affects MBS Single-A version V1_0_0_0. It arises from the ugw-delete-file method, which does not properly validate user-supplied input, allowing a remote attacker with user privileges to delete arbitrary files on the local system. This is classified under CWE-73 (External Control of File Name or Path). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability. No vendor-provided patch or remediation level is currently documented.

An attacker with user privileges can remotely delete arbitrary local files on the affected system, potentially disrupting service or causing data loss. The integrity and availability of the system are impacted. There is no indication of confidentiality impact. No known exploits are reported in the wild, but the vulnerability poses a high risk due to the ability to delete files remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to trusted users only and monitor for suspicious activity related to file deletion commands. Avoid exposing the vulnerable service to untrusted networks if possible.