The vulnerability identified as CVE-2026-35079 affects the MBS Single-A product. It involves the ugw-restore method, which improperly validates user-controlled input, allowing a remote attacker with user privileges to delete arbitrary local files on the system. This is categorized under CWE-73 (External Control of File Name or Path). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond user level, no user interaction, and high impact on integrity and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker with user privileges can remotely delete arbitrary local files on the affected system. This can lead to loss of critical data, disruption of service, and potential system instability. The integrity and availability of the system are highly impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges where possible and monitor for suspicious activity related to the ugw-restore method. Avoid exposing the vulnerable functionality to untrusted users.