The vulnerability identified as CVE-2026-35082 affects the MBS Single-A product. It is classified as CWE-22, indicating improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. The ugw-logread method does not adequately validate user input, enabling a remote attacker with user privileges to access arbitrary files on the local system. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available, and the product is not a cloud service.

An attacker with user privileges can exploit this vulnerability to read arbitrary local files on the affected system. This can lead to unauthorized disclosure of sensitive information, potential compromise of system integrity, and disruption of availability depending on the files accessed. The high CVSS score indicates significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to file access. Avoid exposing the ugw-logread method to untrusted users if possible.