NatJack Attacks Exploit NAT State to Hijack TCP Sessions and Spoof DNS

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that exploits network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables. The research was presented at Black Hat USA 2026 and affects network infrastructure devices, virtualization, containerization, and cloud infrastructure across Windows, Linux, and macOS implementations.

Two implementation-specific flaws were assigned CVEs: CVE-2026-56181 (CVSS 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack. The attack model places an attacker-controlled system behind the same NAT infrastructure as the victim, with capabilities varying by technique and platform. The research groups NatJack into five attacks: UDP DNS hijacking, two TCP/IP hijacking variants, victim IP/port disclosure, and denial of service.

In the DNS attack, the attacker fills the NAT table with dummy entries to evict the victim’s pending DNS entry, then creates replacement entries pointing to the attacker. The legitimate DNS response is sent to the attacker, who then sends a spoofed replacement response to the victim. For TCP, Stagg demonstrated downstream and upstream spoofing variants that remove and replace a victim’s NAT entry to hijack the connection. The upstream variant works even when attacker and victim are in different subnets and broadcast domains.

Stagg’s Black Hat presentation states that 13 vendors were notified, 32 products and configurations were tested, 95 test reports were produced, and seven proof-of-concept exploits plus product-specific variants were developed. All tested products were vulnerable. The presentation names the 13 vendors but does not include a complete product-and-configuration matrix. As of August 7, 2026, there is no public evidence of exploitation in the wild.

For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because conntrack logic failed to validate its direction. Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. Microsoft’s CNA record describes the Windows issue as an origin-validation error enabling spoofing from an adjacent network. Affected releases include Windows 11 24H2 before 26100.8875, 25H2 before 26200.8875, 26H1 before 28000.2525, and Windows Server 2025 before 26100.33158.

Mitigation guidance emphasizes separating untrusted workloads from trusted systems sharing NAT infrastructure. There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates, encrypt traffic even within internal networks, and use IP Source Guard where applicable. Apple considered the macOS behavior a known transport-layer limitation rather than a vulnerability and is considering additional hardening.