PT-2026-26467 · Ella Core · Ella Core

P1-Aji · Published 2026-03-19 · Updated 2026-03-27 · CVE-2026-33281

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.6.0

Description Ella Core, a 5G core designed for private networks, experiences a panic when processing NGAP messages containing invalid PDU Session IDs outside the range of 1-15. An attacker capable of sending specially crafted NGAP messages to Ella Core can cause a process crash, leading to service disruption for all connected subscribers. No authentication is required to exploit this issue. The vulnerability is related to insufficient validation of PDU Session IDs during NGAP message handling.

Recommendations Update to version 1.6.0 or later, which includes PDU Session ID validations during NGAP message handling.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2026-33281

GHSA-Q669-4GMV-G8MF

GO-2026-4783

SUSE-SU-2026:1135-1

Affected Products

Ella Core

References · 148

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33281.json · Exploit
• https://github.com/ellanetworks/core/security/advisories/GHSA-q669-4gmv-g8mf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33281 · Security Note
• https://osv.dev/vulnerability/GHSA-q669-4gmv-g8mf · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4783 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33281 · Vendor Advisory
• https://github.com/ellanetworks/core · Note
• https://suse.com/security/cve/CVE-2026-33132 · Note
• https://suse.com/security/cve/CVE-2026-33247 · Note
• https://suse.com/security/cve/CVE-2026-30886 · Note
• https://suse.com/security/cve/CVE-2026-33638 · Note
• https://suse.com/security/cve/CVE-2026-32769 · Note
• https://suse.com/security/cve/CVE-2026-32305 · Note
• https://suse.com/security/cve/CVE-2026-24692 · Note