The vulnerability identified as CVE-2026-35080 affects the MBS Single-A product. It involves the ugw-restoreinfo method, which improperly validates user-supplied input controlling file names or paths. This flaw enables a remote attacker with user-level privileges to delete arbitrary files on the local system. The CVSS 4.0 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

An attacker with user privileges can remotely delete arbitrary files on the affected system, potentially leading to data loss or disruption of service. The vulnerability impacts system integrity and availability but does not affect confidentiality. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges where possible and monitor for suspicious activity related to file deletion. Avoid exposing the ugw-restoreinfo method to untrusted users if feasible.