PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44474 ellanetworks CVE debrief

A race condition in Ella Core prior to 1.10.0 allows concurrent execution of NAS Security Mode Command and N2 handover procedures, violating 3GPP TS 33.501 §6.9.5.1. This produces a KgNB key mismatch between UE and target gNB, causing handover failure. Exploitation requires a stalled gNB combined with a re-registration race condition. The vulnerability is rated LOW severity (CVSS 3.7) due to adjacent network access requirements, high attack complexity, and limited privileges needed. No known exploitation in the wild.

Vendor
ellanetworks
Product
core
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Operators of private 5G networks using Ella Core; telecommunications security engineers; 5G core infrastructure administrators

Technical summary

Ella Core versions before 1.10.0 fail to enforce mutual exclusion between NAS Security Mode Command and N2 handover procedures as required by 3GPP TS 33.501 §6.9.5.1. When both procedures execute concurrently, the UE and target gNB derive mismatched KgNB keys, causing handover failure. The vulnerability requires specific timing: a stalled gNB state combined with UE re-registration race. This is a protocol state machine flaw rather than cryptographic weakness. The fix in 1.10.0 adds proper security procedure sequencing enforcement.

Defensive priority

LOW

Recommended defensive actions

  • Upgrade Ella Core to version 1.10.0 or later to resolve the KgNB mismatch vulnerability
  • Monitor gNB health to detect stalled states that could contribute to race condition triggering
  • Review 3GPP TS 33.501 §6.9.5.1 implementation for additional security procedure ordering constraints
  • Validate handover success rates in private 5G deployments as potential indicator of exploitation attempts

Evidence notes

Official CVE record published 2026-05-27. Advisory confirms fix in Ella Core 1.10.0. CWE-358 (Improperly Implemented Security Check for Standard) assigned. CVSS vector AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L reflects adjacent access, high complexity, and low integrity/availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44474 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44474

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44474 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44474

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.