Security researcher Malcolm Stagg has unveiled a new class of attacks termed ‘NatJack,’ which exploit vulnerabilities in Network Address Translation (NAT) implementations to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. These findings were presented at Black Hat USA 2026.
NAT is a method used in networks to remap IP addresses by modifying network address information in packet headers. This process allows multiple devices on a local network to be mapped to a single public IP address, conserving the number of public IP addresses used and adding a layer of security by masking internal IP addresses.
Stagg’s research identified that certain NAT implementations, including those in Windows and Linux systems, are susceptible to manipulation. Specifically, two vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) identifiers: CVE-2026-56181 in Windows NAT used by Hyper-V, and CVE-2026-63913 in Linux Netfilter conntrack, with CVSS scores of 8.3 and 8.2, respectively.
The NatJack attacks generally require the attacker to have privileged access to a system behind the same NAT as the victim. This means that an attacker within the same local network can exploit these vulnerabilities to manipulate the NAT connection state of another device on the network. The attack methods include redirecting traffic from an active TCP connection by altering its NAT mapping, intercepting a victim’s DNS request to send a forged response, exposing externally mapped ports, and filling the NAT connection table with spoofed flows to prevent legitimate connections.
Stagg tested these techniques against numerous real-world network infrastructure products from multiple vendors, demonstrating proof-of-concept exploitation in controlled environments. However, as of August 7, 2026, there is no public evidence that NatJack techniques have been exploited in the wild.
To mitigate these vulnerabilities, organizations are advised to apply available updates for Windows and Linux systems. Additionally, encrypting traffic within internal networks and implementing Internet Protocol (IP) Source Guard where applicable can provide further protection. It’s also recommended to separate untrusted workloads from trusted systems that share NAT infrastructure to minimize the risk of internal attacks.
These findings build upon earlier research into NAT-state manipulation. A study presented at the Network and Distributed System Security Symposium (NDSS) in 2024 demonstrated TCP hijacking through NAT mapping manipulation, revealing that 52 out of 67 tested routers were susceptible to such attacks, leading to the assignment of ten CVEs.
The NatJack vulnerabilities underscore the importance of scrutinizing NAT implementations and adopting comprehensive security measures to protect against potential exploits. As network infrastructures continue to evolve, staying vigilant and proactive in addressing such vulnerabilities is crucial to maintaining robust cybersecurity defenses.
