CVE-2026-44475
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
May 27, 2026
CISA due date
—
The record
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-46582 In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as… CWE-358
- CVE-2026-49783 Improperly implemented security check for standard in Windows Secure Boot allows an… CWE-358
- CVE-2026-11122 Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed… CWE-358
- CVE-2026-11127 Inappropriate implementation in WebAPKs in Google Chrome on Android prior to… CWE-358
- CVE-2026-44473 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-44474 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-42082 free5GC is an open-source implementation of the 5G core network. CWE-358
- CVE-2026-42081 free5GC is an open-source implementation of the 5G core network. CWE-358