New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

CVE-2026-56181CVE-2026-63913

August 7, 2026 · The Hacker News · Severity: HIGH

Security researcher Malcolm Stagg has uncovered a new attack class called NatJack that exploits vulnerabilities in network address translation (NAT) implementations to hijack TCP sessions, spoof DNS responses, and disrupt network connectivity. The flaws affect both Windows (CVE-2026-56181, CVSS 8.3) and Linux (CVE-2026-63913, CVSS 8.2) systems, particularly in Hyper-V and Netfilter conntrack components. Attackers with privileged access to a system behind the same NAT as the victim can manipulate connection-tracking entries to redirect traffic, forge DNS responses, or exhaust NAT tables. The research, presented at Black Hat USA 2026, highlights a critical assumption in NAT implementations that trusted hosts won't manipulate each other's connection state. Mitigations include applying available patches for Windows and Linux, encrypting internal traffic, and segregating untrusted workloads from trusted systems. While kernel updates for Linux and Windows address specific flaws, they only partially mitigate the broader attack techniques. Stagg tested these methods against multiple vendors' infrastructure, though no real-world exploits have been reported yet. The findings build on prior research into NAT manipulation, including an NDSS 2024 study that exposed vulnerabilities in 52 of 67 tested routers. Organizations are urged to review their NAT configurations and implement additional safeguards like IP Source Guard where possible.

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026 , the research found affected behavior across independently developed implementations, including Windows and Linux. Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack. NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure. There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates and encrypt traffic even within internal networks.

Key Takeaways

NatJack attacks exploit fundamental NAT vulnerabilities to hijack TCP sessions and spoof DNS across Windows (CVE-2026-56181, CVSS 8.3) and Linux (CVE-2026-63913, CVSS 8.2).
Affected components include Windows Hyper-V NAT and Linux Netfilter conntrack — attackers with local access behind the same NAT can redirect traffic and forge responses.
Mitigations include applying kernel patches, encrypting internal traffic, and segregating untrusted workloads from trusted systems.