Is CVE-2026-44473 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44473 being exploited in the wild.

How severe is CVE-2026-44473?

High severity, with a CVSS score of 7.1, published 27 May 2026.

Which products and versions are affected?

Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.

Is there a fix for CVE-2026-44473?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44473 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-44473?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44473: Ella Networks Ella Core traffic redirection in NGAP handling

Q: Is there a fix for CVE-2026-44473?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44473 attacked?

It is attacked from the adjacent network, in a hosted service.

Q: Am I affected by CVE-2026-44473?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44473 · Severity: high · CVSS 7.1 · Published 2026-05-27

Ella Core, a software component used in private 5G networks, is vulnerable to a flaw that allows an attacker to intercept mobile device traffic. By sending a forged message from a connected radio, an attacker can trick the core network into redirecting a user's data downloads to the attacker's equipment. This could lead to unauthorized data access or a complete loss of service for the affected mobile user.

Technologies: Ella Networks Ella Core, github.com/ellanetworks/core (Go). Vendors: Ella Networks, Go.

Quick answers

Is CVE-2026-44473 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44473 being exploited in the wild.
How severe is CVE-2026-44473?: High severity, with a CVSS score of 7.1, published 27 May 2026.
Which products and versions are affected?: Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.
Is there a fix for CVE-2026-44473?: Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44473 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-44473?: Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later
```
go get github.com/ellanetworks/core@v1.10.0
```

Technical details

Ella Core fails to verify that a PDUSessionResourceSetupResponse message arrives on the specific SCTP association bound to a User Equipment's (UE) logical NG-connection. An attacker with a valid NG Setup can send a forged response containing a target UE's AMF-UE-NGAP-ID. The core network then incorrectly creates a GTP tunnel towards the attacker's radio, redirecting all downlink user-plane traffic for that UE. This vulnerability is classified under CWE-358 (Improperly Implemented Security Check) and CWE-863 (Incorrect Authorization). A fix is available in version 1.10.0 which scopes UE context lookups to the sending radio's SCTP association.

Affected products

Ella Networks core < 1.10.0

Identifiers

CVE-2026-44473
GHSA-qfxw-v8qx-vj3v
GO-2026-5581

Timeline

2026-05-06: disclosed
2026-05-11: advisory: GitHub Advisory published
2026-05-27: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.