{"id":"EUVD-2026-32561","enisaUuid":"60ab66bd-c6c5-3d7f-930b-88ef86ac54f4","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn\u0027t enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:14:49 PM","dateUpdated":"May 27, 2026, 5:23:14 PM","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q\n","aliases":"CVE-2026-44474\nGHSA-mc29-hmx6-856q\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"31013509-78fd-3707-8fba-2aad47e6d8ae","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"enisaIdVendor":[{"id":"785362d5-58ee-38ed-b312-ab32a2f75d14","vendor":{"name":"ellanetworks"}}],"enisaIdVulnerability":[{"id":"6f81bd89-d94b-3427-95a5-e2e63747ee17","vulnerability":{"id":"GHSA-mc29-hmx6-856q","description":"Ella Core has handover failures during concurrent Security Mode Command","datePublished":"May 11, 2026, 3:29:41 PM","dateUpdated":"Jun 8, 2026, 11:48:56 PM","baseScore":0.0,"references":"https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44474\nhttps://github.com/ellanetworks/core\n","enisa_id":"EUVD-2026-32561\n","aliases":"GHSA-mc29-hmx6-856q\nCVE-2026-44474\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ff0c88d6-e483-38fb-af2f-396a9448f0fe","vulnerability":{"id":"CVE-2026-44474","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn\u0027t enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:14:49 PM","dateUpdated":"May 27, 2026, 5:23:14 PM","status":"PUBLISHED","baseScore":3.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q\n","enisa_id":"EUVD-2026-32561\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Nov 5, 2026, 7:18:12 AM","vulnerabilityProduct":[{"id":"a6a83a37-56f5-3323-a9be-2db47a09f00d","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"vulnerabilityVendor":[{"id":"df8c8d45-d79f-31a9-ae4a-17447ae54ab6","vendor":{"name":"ellanetworks"}}]}}],"enisaIdAdvisory":[]}