NatJack is a new class of cyberattacks discovered by security researcher Malcolm Stagg and presented at Black Hat USA 2026. NatJack exploits the way many Network Address Translation (NAT) implementations manage connection state, allowing an attacker to hijack active TCP sessions , forge DNS responses, reveal mapped ports, and exhaust the NAT table, causing a denial of service . The research is a major breakthrough in network security, as it affects widespread infrastructure.
See also: Certighost (CVE-2026-54121): PoC exploit to hijack Windows domains via AD CS
Stagg , who conducted the research independently through SODIUM-24 , found that many NAT implementations rely on a fundamental assumption: devices behind the same NAT will not attempt to manipulate each other's connection state. This assumption has been proven wrong. An attacker controlling a system behind the same NAT as the victim can, depending on the implementation, manipulate connection-tracking entries belonging to another system. This differentiates NatJack from classic adversary-in-the-middle attacks , as it does not require traditional Layer 2 spoofing or access to the same broadcast domain.
Two specific implementation vulnerabilities have been assigned CVE numbers: CVE-2026-56181 with a CVSS score of 8.3 in Windows NAT used by Hyper-V, and CVE-2026-63913 with a CVSS score of 8.2 in Linux Netfilter conntrack. Both scores are classified as high severity, reflecting the serious risk of exploitation in production environments.
How NatJack Works: Technical Analysis of Attacks
The research describes four main attack techniques. The first involves redirecting traffic from an active TCP connection by replacing its NAT mapping. The second interferes with DNS : the attacker populates the NAT table with fake entries to flush out the victim's outstanding DNS mapping, then creates a replacement, and the legitimate DNS response ends up with the attacker, who can send a spoofed response to the victim. The third technique reveals externally mapped ports, while the fourth exhausts the NAT table with fake flows until legitimate users cannot establish new connections.
An important technical element that accelerates attacks is the TIME-WAIT of RFC 1337.This TIME-WAIT "killer" mechanism can force NAT entries to leave the table much faster than they normally would, allowing the attacker to replace them with controlled mappings. For TCP hijacking, Stagg demonstrated both downstream and upstream spoofing variants. The upstream case can work even when the attacker and the victim are on different subnets and broadcast domains, which significantly expands the attack surface.
Stagg - world network infrastructure products from multiple vendors and demonstrated proof-of-concept exploitation in a controlled environment. The research identified vulnerable behavior across independently developed implementations, including Windows, Linux , and, according to secondary reports, macOS, suggesting that the attack surface is broad and not limited to a single vendor.
See also: APT28 exploits SOHO routers in DNS Hijacking campaign
NatJack and the broader context: Relationship with previous research
NatJack is not the first research project to examine NAT state manipulation. A NDSS 2024 study had demonstrated TCP hijacking via NAT mapping manipulation and found that 52 of 67 tested routers were vulnerable, generating ten CVEs . The new research builds on that foundation, expanding on known techniques and demonstrating that the problem is deeper than isolated implementation errors — it involves fundamental design assumptions.
Conceptually, NatJack is similar to classic session hijacking and DNS poisoning, but it operates at the NAT layer instead of Layer 2. This means that traditional defenses such as ARP spoofing or broadcast domain isolation are not sufficient to prevent these attacks. The research places NatJack in the same family as state manipulation and traffic redirection attacks, but at a layer that is often considered trustworthy.
It is worth noting that, according to The Hacker News , as of August 7, 2026, there is no public evidence that NatJack techniques have been exploited in practice. However, publishing the research increases the risk, as it provides detailed technical documentation to potential attackers.
NatJack: Who is at risk and how to protect yourself
NatJack requires the attacker to have privileged access to a system behind the same NAT as the victim. This means that environments that mix trusted and untrusted workloads on the same NAT — such as Hyper-V hosts, container platforms, cloud network overlays, and corporate networks with shared NAT infrastructure — are at increased risk. Organizations using Linux conntrack on firewalls or routers should also pay special attention.
There is no single patch for the broader attack class. Stagg points out that the kernel change fixes the code error but only mitigates the broader downstream spoofing technique, increasing the attack complexity without completely eliminating it. This means that even after applying the available updates, the underlying design problem remains.
Organizations should immediately apply the available updates for the CVE-2026-56181 and CVE-2026-63913. In addition, it is recommended to use TLS for traffic confidentiality even within internal networks, deploy DNSSEC and encrypted DNS, and implement IP Source Guard where possible. It is critical to separate trusted and untrusted workloads so that they do not share the same NAT boundary.
See also: CVE-2026-60236: Critical RCE in Oracle Coherence (CVSS 9.8) – what to do now
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
To monitor for potential exploitation, security teams should monitor NAT devices and hypervisors for signs of abuse, such as a full or nearly full NAT table, high-volume TCP/UDP floods across wide port ranges, unexpected SYN and RST, and the same public IP appearing in multiple physical locations, which may indicate session manipulation or mapping abuse. Addressing NatJack requires both a patching approach and a review of the network architecture, as even where fixes are in place, the underlying NAT trust assumption may create residual risk.
