CVE-2026-34762

CVE-2026-34762 is a low-severity improper input validation vulnerability affecting Ella Core, a 5G core solution for private networks, in versions prior to 1.8.0. An authenticated NetworkManager can exploit a flaw in the PUT /api/v1/subscriber/{imsi} API, where the IMSI in the URL path and JSON request body are not verified to match. This allows the attacker to modify any subscriber's policy while the audit trail falsely records a different IMSI, resulting in a low integrity impact (CVSS 2.7). There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.