New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.

Presented at Black Hat USA 2026, the research found affected behavior across independently developed implementations, including Windows and Linux.

Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.

NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure.

There is no single patch for the broader attack class. Organizations should apply available Windows and Linux updates and encrypt traffic even within internal networks. The research also recommends Internet Protocol (IP) Source Guard where applicable.

The NatJack research, conducted independently by Stagg through SODIUM-24, targets an assumption built into many NAT implementations: hosts behind the same NAT are generally assumed not to manipulate one another’s connection state. An attacker controlling a system behind the same NAT can, depending on the implementation, manipulate connection-tracking entries belonging to another system.

The research describes four main paths. One can redirect traffic from an active TCP connection by replacing its NAT mapping. Another interferes with a victim’s DNS request so the legitimate DNS response reaches the attacker, allowing a forged response to be sent back.

Other techniques disclose externally mapped ports or fill the NAT connection table with spoofed flows until legitimate clients cannot create new connections.

Synack said Stagg tested the techniques against dozens of real-world network infrastructure products from multiple vendors and demonstrated proof-of-concept exploitation in a controlled environment.

The NatJack site does not publish a complete product-by-product matrix. The Hacker News found no public evidence that NatJack techniques have been exploited in the wild as of August 7, 2026.