The vulnerability CVE-2026-35078 affects the MBS Single-A product. It involves the ugw-logstop method, which fails to sufficiently validate user-controlled input, enabling a remote attacker who has user-level privileges to delete arbitrary files on the local system. This is classified under CWE-73 (External Control of File Name or Path). The CVSS 4.0 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability. There is no vendor advisory or patch information available at this time.

An attacker with user privileges can remotely delete arbitrary files on the affected system, potentially disrupting system operations or causing data loss. The integrity and availability of the system are impacted. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges and monitor for suspicious activity related to the ugw-logstop method. Avoid exposing vulnerable interfaces to untrusted networks if possible.