New Nat Jack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
Summary: Security researcher Malcolm Stagg disclosed a new attack class called NatJack that manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, with findings presented at Black Hat USA 2026 and affecting independently developed implementations including Windows and Linux. Two implementation-specific flaws received CVEs: CVE-2026-56181 (CVSS 8.3) in Windows NAT used by Hyper-V and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack, and The Hacker News found no public evidence of in-the-wild exploitation as of August 7, 2026.
Bottom line: NatJack requires only privileged access to a system behind the same NAT as the victim, so the shared NAT infrastructure separating untrusted workloads from trusted systems is itself the attack surface, and there is no single patch for the broader attack class.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Mentions
- CVE-2026-56181CVE-2026-63913
- Related
- ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026