The User Plane Function (UPF) is the 5G core component that forwards subscriber data traffic. It sits in the user plane, moving packets between the network and the internet, while control-plane functions such as the SMF tell it how to treat each session. In practice, the UPF applies forwarding rules, routing, and traffic handling instructions.
UPF security matters because a mistake in control signaling can change how traffic flows. If an attacker can send forged or malformed session messages, or exploit weak validation in the control path, the UPF may drop traffic, redirect it, or expose data to the wrong destination. Defenders reduce this risk by tightly restricting PFCP access, validating session state and identifiers, and monitoring for unexpected forwarding-rule changes or session-modification bursts.