# CVE-2026-44474: Ella Networks Ella Core improper security check in 5G NAS procedures

Source: https://junglewise.ai/threats/cve-2026-44474-ella-networks-ella-core-improper-security-check-in-5g-nas  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44474 · Severity: low · CVSS 3.7 · Published 2026-05-27

Ella Core is a 5G core network platform used for private cellular networks. A flaw in how it handles security procedures can cause mobile devices to lose their connection during a handover between base stations. This results in a service outage for the affected user and requires a specific set of network conditions to occur.

Technologies: [Ella Networks Ella Core](https://junglewise.ai/threats/technologies/ella-core), [github.com/ellanetworks/core (Go)](https://junglewise.ai/threats/technologies/github-com-ellanetworks-core). Vendors: [Ella Networks](https://junglewise.ai/threats/vendors/ella-networks), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44474 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44474 being exploited in the wild.

**How severe is CVE-2026-44474?** Low severity, with a CVSS score of 3.7, published 27 May 2026.

**Which products and versions are affected?** Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.

**Is there a fix for CVE-2026-44474?** Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44474 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-44474?** Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later

  ```sh
  go get github.com/ellanetworks/core@v1.10.0
  ```


## Technical details

Ella Core does not properly enforce the 3GPP TS 33.501 §6.9.5.1 standard regarding concurrent security procedures. Specifically, the system may send a NAS Security Mode Command while an N2 handover is still pending, or vice versa. This concurrency creates a KgNB key mismatch between the User Equipment (UE) and the target gNB, causing the handover to fail. Exploitation requires a specific race condition involving a stalled gNB and a re-registration event. The issue is addressed in version 1.10.0 by blocking concurrent Security Mode Command and N2 handover procedures.

## Affected products

- Ella Networks core < 1.10.0

## Identifiers

- CVE-2026-44474
- GHSA-mc29-hmx6-856q
- GO-2026-5502

## Timeline

- 2026-05-06: disclosed: Initial disclosure to vendor
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published date

## References

- [https://api.github.com/users/SJNA0414](https://api.github.com/users/SJNA0414)
- [https://github.com/SJNA0414](https://github.com/SJNA0414)
- [https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D](https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D)
- [https://api.github.com/users/SJNA0414/repos](https://api.github.com/users/SJNA0414/repos)
- [https://avatars.githubusercontent.com/u/197385222?v=4](https://avatars.githubusercontent.com/u/197385222?v=4)
- [https://api.github.com/users/SJNA0414/events%7B/privacy%7D](https://api.github.com/users/SJNA0414/events%7B/privacy%7D)

## Related threats

- [Ella Networks Ella Core security bypass in NGAP PathSwitchRequest](https://junglewise.ai/threats/cve-2026-44475-ella-networks-ella-core-security-bypass-in-ngap-pathswitchrequest)
- [Ella Networks Ella Core traffic redirection in NGAP handling](https://junglewise.ai/threats/cve-2026-44473-ella-networks-ella-core-traffic-redirection-in-ngap-handling)
- [Ella Networks Ella Core audit log falsification in subscriber API](https://junglewise.ai/threats/cve-2026-34762-ella-networks-ella-core-audit-log-falsification-in-subscriber-api)
- [Ella Networks Ella Core NULL pointer dereference in NGAP handover](https://junglewise.ai/threats/cve-2026-34761-ella-networks-ella-core-null-pointer-dereference-in-ngap-handover)
- [GO-2026-4872 - Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core](https://junglewise.ai/threats/cve-2026-33907-ella-core-panics-during-nas-authentication-response-failure-with)