CVE-2026-44475

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.

• CWE-358

• https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44469The affected product extracts installation files to a tempor…7
• CVE-2026-4447Inappropriate implementation in V8 in Google Chrome prior to…8.8
• CVE-2026-44470The Claude Desktop app gives you Claude Code with a graphica…7.8
• CVE-2026-44471gitoxide is an implementation of git written in Rust. Prior …7.8
• CVE-2026-44473Ella Core is a 5G core designed for private networks. Prior …7.1
• CVE-2026-44474Ella Core is a 5G core designed for private networks. Prior …3.7
• CVE-2026-44477CloudNativePG is a platform designed to manage PostgreSQL da…9.9
• CVE-2026-44478hoppscotch is an open source API development ecosystem. The …7.5
• CVE-2026-44479Vercel’s AI Cloud is a unified platform for building modern …5.5
• CVE-2026-4448Heap buffer overflow in ANGLE in Google Chrome prior to 146.…8.8
• CVE-2026-44482soundcloud-rpc is a SoundCloud Client with Discord Rich Pres…9.6
• CVE-2026-44483RVF (formerly Remix Validated Form) provides easy form valid…8.2