{"id":"EUVD-2026-32562","enisaUuid":"96d21491-1702-3d3d-801e-8f26df7d7ba4","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core\u0027s stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:15:27 PM","dateUpdated":"May 28, 2026, 3:36:26 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj\n","aliases":"CVE-2026-44475\nGHSA-pwfh-mqp3-pqwj\n","assigner":"GitHub_M","epss":0.15,"enisaIdProduct":[{"id":"6550da72-39ef-35b9-885b-f919f0f69d40","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"enisaIdVendor":[{"id":"4e485bb8-36b7-3c07-9cc2-cb0a285d6c01","vendor":{"name":"ellanetworks"}}],"enisaIdVulnerability":[{"id":"24f5a057-1cc9-3296-b634-077a98f8e90a","vulnerability":{"id":"GHSA-pwfh-mqp3-pqwj","description":"Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest","datePublished":"May 11, 2026, 3:29:37 PM","dateUpdated":"Jun 8, 2026, 11:48:59 PM","baseScore":0.0,"references":"https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44475\nhttps://github.com/ellanetworks/core\n","enisa_id":"EUVD-2026-32562\n","aliases":"GHSA-pwfh-mqp3-pqwj\nCVE-2026-44475\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d83ffa86-746c-3c20-981c-9a8fcc25d8cd","vulnerability":{"id":"CVE-2026-44475","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core\u0027s stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.","datePublished":"May 27, 2026, 3:15:27 PM","dateUpdated":"May 28, 2026, 3:36:26 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L","references":"https://github.com/ellanetworks/core/security/advisories/GHSA-pwfh-mqp3-pqwj\n","enisa_id":"EUVD-2026-32562\n","assigner":"GitHub_M","epss":0.15,"dataProcessed":"Oct 30, 2026, 7:17:58 AM","vulnerabilityProduct":[{"id":"43b4e94b-15c8-3c9a-b7b4-2d9edfb56104","product":{"name":"core","vendor":{"name":"OPNsense"}},"product_version":"\u003c 1.10.0"}],"vulnerabilityVendor":[{"id":"ad916c0f-3ce0-306d-9383-133b90323f1c","vendor":{"name":"ellanetworks"}}]}}],"enisaIdAdvisory":[]}