The vulnerability identified as CVE-2026-35079 affects the MBS Single-A product, specifically version V1_0_0_0. It involves the ugw-restore method, which improperly validates user-supplied input controlling file names or paths. This flaw allows a remote attacker with user privileges to delete arbitrary files on the local system. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond user level, no user interaction, and high impact on integrity and availability. The vulnerability is categorized under CWE-73 (External Control of File Name or Path). No patch or official remediation level has been published by the vendor as of the data provided.

An attacker with user-level privileges can exploit this vulnerability to delete arbitrary files on the affected system, potentially disrupting system operations or causing data loss. The impact affects system integrity and availability. Since the attacker requires user privileges, exploitation is limited to authenticated or authorized users. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to the minimum necessary and monitor for suspicious activity related to file deletions. Avoid granting unnecessary access to the ugw-restore method or related functionality. Follow vendor updates closely for any forthcoming patches or mitigations.