The vulnerability identified as CVE-2026-35080 affects MBS Single-A version V1_0_0_0. It involves the ugw-restoreinfo method, which fails to sufficiently validate user-controlled input, enabling a remote attacker with user privileges to delete arbitrary files on the local system. This is categorized under CWE-73 (External Control of File Name or Path). The CVSS 4.0 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required beyond user level, and no user interaction needed. The vulnerability impacts confidentiality and availability significantly. No official remediation or patch has been documented, and no known exploits are reported.

An attacker with user-level privileges can remotely delete arbitrary local files on the affected system, potentially leading to loss of critical data and disruption of service availability. The confidentiality of the system may also be impacted due to unauthorized file manipulation. The vulnerability does not require user interaction and can be exploited remotely with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict user privileges where possible and limit access to the ugw-restoreinfo method to trusted users only.