CVE-2026-44474 Overview
CVE-2026-44474 affects Ella Core, a 5G core designed for private networks. Versions prior to 1.10.0 fail to enforce security rules on the concurrent execution of security procedures defined in 3GPP TS 33.501 §6.9.5.1. The core can transmit a Non-Access Stratum (NAS) Security Mode Command while an N2 handover is still pending, or the reverse sequence. This concurrency produces a KgNB key mismatch between the User Equipment (UE) and the target gNB, causing the handover to fail. The issue is tracked under [CWE-358] (Improperly Implemented Security Check for Standard).
Critical Impact
An adjacent-network attacker leveraging a stalled gNB and a re-registration race can cause handover failures and disrupt UE mobility on private 5G networks.
Affected Products
- Ella Core versions prior to 1.10.0
Discovery Timeline
- 2026-05-27 - CVE-2026-44474 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-44474
Vulnerability Analysis
The vulnerability resides in Ella Core's handling of concurrent 5G NAS and N2 signaling procedures. 3GPP TS 33.501 §6.9.5.1 prohibits running a NAS Security Mode Command procedure in parallel with an N2 handover because both procedures derive or transition the KgNB key. Ella Core does not enforce this mutual exclusion. When both procedures execute concurrently, the UE and the target gNB compute different KgNB values. The handover authentication then fails because the access stratum keys no longer match. The result is a denial of service against UE mobility, scoped to the affected session.
Root Cause
The root cause is a missing concurrency guard around security-sensitive 5G control-plane procedures. Ella Core lacks state tracking that would reject or defer a NAS Security Mode Command when an N2 handover is pending, and the inverse. This is a standards-compliance gap rather than a cryptographic weakness, classified as [CWE-358].
Attack Vector
Exploitation requires adjacent network access to the 5G control plane and the ability to influence procedure timing. The triggering condition is a stalled gNB combined with a UE re-registration race. An attacker must induce the conditions where the core issues a NAS Security Mode Command while an N2 handover remains pending. The high attack complexity and required low privileges limit practical exploitation to environments where the adversary already has access to the radio access network or N2 interface.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory for protocol-level details.
Detection Methods for CVE-2026-44474
Indicators of Compromise
- Repeated N2 handover failures correlated with KgNB mismatch errors logged by gNBs or the core.
- UE re-registration events that immediately follow handover failures on the same session.
- Stalled or unresponsive gNB sessions observed prior to the failed handover sequence.
Detection Strategies
- Monitor Ella Core logs for concurrent NAS Security Mode Command and N2 handover state transitions on the same UE context.
- Alert on access stratum key derivation failures reported by target gNBs during Xn or N2-based handovers.
- Correlate UE context identifiers across NAS and N2 procedures to surface overlapping security procedures.
Monitoring Recommendations
- Ingest 5G core control-plane logs into a centralized analytics platform and baseline normal handover success rates.
- Track per-gNB stall and timeout metrics to identify the precondition required for the race.
- Establish thresholds on consecutive handover failures per UE and per gNB to flag exploitation attempts.
How to Mitigate CVE-2026-44474
Immediate Actions Required
- Upgrade Ella Core to version 1.10.0 or later, which enforces the TS 33.501 §6.9.5.1 concurrency restriction.
- Inventory all Ella Core deployments in private 5G environments and identify versions below 1.10.0.
- Restrict N2 interface access to authorized gNBs only, using network segmentation and mutual authentication.
Patch Information
The maintainers fixed CVE-2026-44474 in Ella Core 1.10.0. The patch enforces the standardized rule that NAS Security Mode Command and N2 handover procedures cannot run concurrently for the same UE context. Refer to the Ella Networks GitHub Security Advisory GHSA-mc29-hmx6-856q for fix details and upgrade guidance.
Workarounds
- No vendor-supplied workaround is documented; upgrading to 1.10.0 is the supported remediation.
- Reduce gNB instability that produces stalled sessions, since the race requires a stalled gNB to trigger.
- Limit exposure of the N2 control-plane interface to trusted radio access network elements.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
