Executive Summary
In August 2026, security researcher Malcolm Stagg unveiled 'NatJack,' a novel attack class that exploits vulnerabilities in Network Address Translation (NAT) implementations to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. The research identified two critical vulnerabilities: CVE-2026-56181 in Windows NAT used by Hyper-V and CVE-2026-63913 in Linux Netfilter conntrack. These flaws allow attackers with privileged access to a system behind the same NAT as the victim to manipulate connection states, leading to potential data interception and service disruptions. Organizations are advised to apply the latest patches and implement network segmentation to mitigate these risks.
The NatJack disclosure underscores the evolving threat landscape targeting network infrastructure. As attackers continue to find and exploit design assumptions in widely used technologies, it is imperative for organizations to reassess their network security postures, prioritize internal traffic encryption, and adopt zero-trust principles to safeguard against such sophisticated attacks.
Why This Matters Now
The NatJack attack highlights critical vulnerabilities in NAT implementations, emphasizing the need for organizations to promptly apply patches and strengthen internal network defenses to prevent potential data breaches and service disruptions.
Attack Path Analysis
An attacker with privileged access to a system behind the same NAT as the victim exploits vulnerabilities in NAT implementations to manipulate connection states, hijack active TCP sessions, and spoof DNS responses. This allows the attacker to escalate privileges by intercepting and modifying network traffic. The attacker moves laterally by accessing other systems behind the same NAT, exploiting the manipulated connections. Command and control are established through the hijacked sessions, enabling the attacker to issue commands remotely. Data exfiltration occurs as the attacker redirects sensitive information through the compromised connections. The impact includes potential data breaches, service disruptions, and exposure of internal network structures.
Kill Chain Progression
Initial Compromise
Description
An attacker with privileged access to a system behind the same NAT as the victim exploits vulnerabilities in NAT implementations to manipulate connection states, hijack active TCP sessions, and spoof DNS responses.
Related CVEs
CVE-2026-56181
CVSS 8.3An origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
Affected Products:
Microsoft Windows 11 Version 24H2 – 10.0.26100.0 to 10.0.26100.8874
Microsoft Windows 11 Version 25H2 – 10.0.26200.0 to 10.0.26200.8874
Microsoft Windows 11 Version 26H1 – 10.0.28000.0 to 10.0.28000.2524
Microsoft Windows Server 2025 – 10.0.26100.0 to 10.0.26100.33157
Microsoft Windows Server 2025 (Server Core installation) – 10.0.26100.0 to 10.0.26100.33157
Exploit Status:
no public exploitCVE-2026-63913
CVSS 8.2In the Linux kernel, an unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number.
Affected Products:
Linux Kernel – 5.10.0 to 5.10.258, 5.15.0 to 5.15.209, 6.1.0 to 6.1.175, 6.6.0 to 6.6.142, 6.12.0 to 6.12.92, 6.18.0 to 6.18.34, 7.0.0 to 7.0.11, 7.1.0 to 7.1.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Network Address Translation Traversal
Network Sniffing
Network Denial of Service
Disable or Modify System Firewall
Network Service Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment.
Control ID: 1.2.1
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Network Segmentation
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Telecommunications
Critical NAT infrastructure vulnerabilities enable TCP session hijacking and DNS spoofing, directly compromising core network services and customer communications across telecom operations.
Financial Services
NatJack attacks threaten transaction integrity through session hijacking and traffic redirection, potentially bypassing PCI compliance controls and compromising sensitive financial data flows.
Health Care / Life Sciences
Network infrastructure attacks jeopardize HIPAA compliance through lateral movement capabilities, enabling unauthorized access to protected health information via NAT table manipulation.
Information Technology/IT
Windows Hyper-V and Linux Netfilter vulnerabilities directly impact IT infrastructure security, requiring immediate patching and network segmentation to prevent connection state manipulation.
Sources
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tableshttps://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.htmlVerified
- Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructurehttps://blackhat.com/us-26/briefings/schedule/#breaking-trust-boundaries-exploiting-design-assumptions-in-network-infrastructure-53311Verified
- CVE-2026-56181 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2026-56181Verified
- CVE-2026-63913 Detailhttps://nvd.nist.gov/vuln/detail/CVE-2026-63913Verified
- NatJack: Exploiting Design Assumptions in Network Infrastructurehttps://natjack.io/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to exploit NAT vulnerabilities, reducing the potential for lateral movement and data exfiltration within the cloud environment.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit NAT vulnerabilities and manipulate connection states would likely be constrained, reducing the risk of session hijacking and DNS spoofing.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to intercept and modify network traffic to escalate privileges would likely be constrained, reducing unauthorized access to sensitive systems.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally within the network would likely be constrained, reducing the spread to other systems behind the same NAT.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels would likely be constrained, reducing remote control over compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate data through compromised connections would likely be constrained, reducing unauthorized data transfer to external servers.
The overall impact of the attack would likely be reduced, limiting data breaches, service disruptions, and exposure of internal network structures.
Impact at a Glance
Affected Business Functions
- Network Security
- IT Operations
- Data Integrity
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of internal network configurations and active session data.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate untrusted workloads from trusted systems sharing NAT infrastructure.
- • Deploy East-West Traffic Security controls to monitor and restrict lateral movement within the network.
- • Utilize Encrypted Traffic (HPE) solutions to secure data in transit, mitigating risks from traffic interception.
- • Apply Multicloud Visibility & Control measures to detect and respond to anomalous network behaviors.
- • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration through compromised connections.
