CVE-2026-44474
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
May 27, 2026
CISA due date
—
The record
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-46582 In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as… CWE-358
- CVE-2026-49783 Improperly implemented security check for standard in Windows Secure Boot allows an… CWE-358
- CVE-2026-11122 Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed… CWE-358
- CVE-2026-11127 Inappropriate implementation in WebAPKs in Google Chrome on Android prior to… CWE-358
- CVE-2026-44475 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-44473 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-42082 free5GC is an open-source implementation of the 5G core network. CWE-358
- CVE-2026-42081 free5GC is an open-source implementation of the 5G core network. CWE-358