New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
Malcolm Stagg, a security researcher, has revealed a new attack class called NatJack that modifies the network address translation (NAT) connection state in order to expose mapped ports, fake DNS replies, hijack active TCP sessions, and exhaust NAT tables.
The study, which was presented at Black Hat USA 2026, discovered impacted behavior in independently built implementations, such as Linux and Windows.
CVEs have been awarded to two implementation-specific flaws: CVE-2026-56181 (CVSS score: 8.3) in Hyper-V's Windows NAT and CVE-2026-63913 (CVSS score: 8.2) in the Linux Netfilter connection.
In most cases, NatJack needs the attacker to have privileged access to a system that is protected by the same NAT as the victim. As a result, the mitigating recommendation places a strong emph...