Malcolm Stagg, a security researcher, has unveiled a new type of attack named NatJack, which targets network address translation (NAT) systems to hijack ongoing TCP sessions, falsify DNS responses, reveal mapped ports, and overwhelm NAT tables. This groundbreaking research was showcased at the Black Hat USA 2026 conference, revealing vulnerabilities in both Windows and Linux systems.
Understanding the NatJack Exploit
The NatJack attack exploits flaws in NAT implementations, affecting both Windows and Linux platforms. Two critical vulnerabilities have been identified: CVE-2026-56181 in Windows NAT utilized by Hyper-V with a CVSS score of 8.3, and CVE-2026-63913 in Linux Netfilter conntrack with a score of 8.2. These vulnerabilities demonstrate how attackers can manipulate NAT connection states, leading to severe security implications.
To execute a NatJack attack, an adversary typically needs privileged access to a system sharing the same NAT as the target. This necessitates robust separation of untrusted and trusted workloads within shared NAT environments to prevent exploitation.
Mitigation Strategies and Current Solutions
There is no comprehensive patch available for the NatJack attack class. Organizations are advised to apply the latest updates for Windows and Linux systems and to encrypt internal network communications. Implementing Internet Protocol (IP) Source Guard can further mitigate potential threats.
The NatJack research highlights a fundamental assumption in many NAT implementations: that systems behind the same NAT do not interfere with each other’s connection states. By exploiting this assumption, an attacker can manipulate connection-tracking entries of other systems, posing significant risks to network security.
Technical Insights and Industry Response
The research outlines several attack vectors, including redirecting traffic from active TCP connections by altering NAT mappings and intercepting DNS requests to send forged responses. Additional techniques involve disclosing externally mapped ports or overloading NAT tables, preventing legitimate client connections.
Synack’s testing of these techniques across various network infrastructure products from different vendors demonstrated proof-of-concept exploitation in controlled environments. However, as of August 7, 2026, there is no public evidence indicating these techniques have been used in real-world attacks.
Linux vulnerabilities are addressed in kernel updates, with fixed versions including 5.10.259 and newer. Although these updates mitigate certain aspects of the attack, they do not completely eliminate the threat. Similarly, Microsoft’s updates address origin-validation errors in Windows, impacting several releases.
NatJack builds on prior research into NAT-state manipulation, with past studies revealing a significant number of routers susceptible to similar attacks, leading to multiple CVE assignments.
As network security continues to evolve, understanding and addressing vulnerabilities like those exploited by NatJack remain crucial for safeguarding systems against sophisticated threats.
