# CVE-2026-44473: Ella Networks Ella Core traffic redirection in NGAP handling

Source: https://junglewise.ai/threats/cve-2026-44473-ella-networks-ella-core-traffic-redirection-in-ngap-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44473 · Severity: high · CVSS 7.1 · Published 2026-05-27

Ella Core, a software component used in private 5G networks, is vulnerable to a flaw that allows an attacker to intercept mobile device traffic. By sending a forged message from a connected radio, an attacker can trick the core network into redirecting a user's data downloads to the attacker's equipment. This could lead to unauthorized data access or a complete loss of service for the affected mobile user.

Technologies: [Ella Networks Ella Core](https://junglewise.ai/threats/technologies/ella-core), [github.com/ellanetworks/core (Go)](https://junglewise.ai/threats/technologies/github-com-ellanetworks-core). Vendors: [Ella Networks](https://junglewise.ai/threats/vendors/ella-networks), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44473 being exploited in the wild.

**How severe is CVE-2026-44473?** High severity, with a CVSS score of 7.1, published 27 May 2026.

**Which products and versions are affected?** Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.

**Is there a fix for CVE-2026-44473?** Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44473 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-44473?** Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later

  ```sh
  go get github.com/ellanetworks/core@v1.10.0
  ```


## Technical details

Ella Core fails to verify that a PDUSessionResourceSetupResponse message arrives on the specific SCTP association bound to a User Equipment's (UE) logical NG-connection. An attacker with a valid NG Setup can send a forged response containing a target UE's AMF-UE-NGAP-ID. The core network then incorrectly creates a GTP tunnel towards the attacker's radio, redirecting all downlink user-plane traffic for that UE. This vulnerability is classified under CWE-358 (Improperly Implemented Security Check) and CWE-863 (Incorrect Authorization). A fix is available in version 1.10.0 which scopes UE context lookups to the sending radio's SCTP association.

## Affected products

- Ella Networks core < 1.10.0

## Identifiers

- CVE-2026-44473
- GHSA-qfxw-v8qx-vj3v
- GO-2026-5581

## Timeline

- 2026-05-06: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published

## References

- [https://api.github.com/users/SJNA0414](https://api.github.com/users/SJNA0414)
- [https://github.com/SJNA0414](https://github.com/SJNA0414)
- [https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D](https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D)
- [https://api.github.com/users/SJNA0414/repos](https://api.github.com/users/SJNA0414/repos)
- [https://avatars.githubusercontent.com/u/197385222?v=4](https://avatars.githubusercontent.com/u/197385222?v=4)
- [https://api.github.com/users/SJNA0414/events%7B/privacy%7D](https://api.github.com/users/SJNA0414/events%7B/privacy%7D)

## Related threats

- [Ella Networks Ella Core security bypass in NGAP PathSwitchRequest](https://junglewise.ai/threats/cve-2026-44475-ella-networks-ella-core-security-bypass-in-ngap-pathswitchrequest)
- [Ella Networks Ella Core improper security check in 5G NAS procedures](https://junglewise.ai/threats/cve-2026-44474-ella-networks-ella-core-improper-security-check-in-5g-nas)
- [Ella Networks Ella Core audit log falsification in subscriber API](https://junglewise.ai/threats/cve-2026-34762-ella-networks-ella-core-audit-log-falsification-in-subscriber-api)
- [Ella Networks Ella Core NULL pointer dereference in NGAP handover](https://junglewise.ai/threats/cve-2026-34761-ella-networks-ella-core-null-pointer-dereference-in-ngap-handover)
- [GO-2026-4872 - Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core](https://junglewise.ai/threats/cve-2026-33907-ella-core-panics-during-nas-authentication-response-failure-with)