The vulnerability identified as CVE-2026-35082 affects MBS Single-A version V1_0_0_0. It is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) path traversal flaw in the ugw-logread method. This flaw allows a remote attacker with user privileges to read arbitrary local files by supplying crafted input that bypasses pathname restrictions. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required beyond user level, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact. No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation is the responsibility of the user/vendor.

Successful exploitation allows a remote attacker with user privileges to read arbitrary local files on the affected system, potentially exposing sensitive information. The vulnerability affects confidentiality, integrity, and availability at a high level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently provided, users should monitor vendor communications for updates. Until a patch is available, restricting user privileges and limiting access to the vulnerable ugw-logread method may reduce risk.