Is CVE-2026-44475 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44475 being exploited in the wild.

How severe is CVE-2026-44475?

Medium severity, with a CVSS score of 6.1, published 27 May 2026.

Which products and versions are affected?

Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.

Is there a fix for CVE-2026-44475?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44475 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-44475?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44475: Ella Networks Ella Core security bypass in NGAP PathSwitchRequest

Q: Is there a fix for CVE-2026-44475?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44475 attacked?

It is attacked from the adjacent network, in a hosted service.

Q: Am I affected by CVE-2026-44475?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44475 · Severity: medium · CVSS 6.1 · Published 2026-05-27

Ella Core is a 5G core network platform used for private cellular networks. A vulnerability in how the system handles handovers between base stations allows a malicious base station to overwrite the security settings of a user's device. This could lead to the corruption of security profiles, potentially impacting the integrity of communications for specific users on the network.

Technologies: Ella Networks Ella Core, github.com/ellanetworks/core (Go). Vendors: Ella Networks, Go.

Quick answers

Is CVE-2026-44475 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44475 being exploited in the wild.
How severe is CVE-2026-44475?: Medium severity, with a CVSS score of 6.1, published 27 May 2026.
Which products and versions are affected?: Ella Networks Ella Core < 1.10.0; github.com/ellanetworks/core (Go) < 1.10.0, SEMVER:introduced=0,fixed=1.10.0.
Is there a fix for CVE-2026-44475?: Yes. github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44475 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-44475?: Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/ellanetworks/core (Go): upgrade to 1.10.0 or later
```
go get github.com/ellanetworks/core@v1.10.0
```

Technical details

Ella Core (prior to version 1.10.0) contains a security check bypass (CWE-358) in its handling of NGAP PathSwitchRequest messages. The component fails to validate the UE Security Capabilities provided in the request against the values locally stored in the core network. An attacker controlling a malicious base station (gNB) can send a crafted PathSwitchRequest to overwrite the stored security capabilities of a target User Equipment (UE) with arbitrary values. This vulnerability is exploitable from an adjacent network (the radio access network) without authentication. The issue is resolved in version 1.10.0, which implements proper verification and logging of mismatches.

Affected products

Ella Networks core < 1.10.0

Identifiers

CVE-2026-44475
GHSA-pwfh-mqp3-pqwj
GO-2026-5554

Timeline

2026-05-06: disclosed: Initial disclosure by researcher
2026-05-11: advisory: GitHub Advisory published
2026-05-27: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.