NatJack Targets NAT Tables: Hijacked Sessions and Exposed Ports

An Attack Class Targeting Connection State

Researcher Malcolm Stagg presented NatJack at Black Hat USA 2026, an attack class that manipates connection state maintained by NAT devices.

The technique can enable attackers to:

• hijack established TCP sessions;
• spoof DNS responses;
• identify ports reachable from the Internet;
• exhaust the NAT table, preventing new legitimate connections.

The attack generally requires privileged control of a system located behind the same NAT as the victim. It relies on a common design assumption: untrusted hosts sharing the device should not be able to modify the state of other hosts’ connections.

The research identified similar behavior in independently developed implementations, including those used by Windows and Linux.

How NatJack Alters Connections

One technique replaces the NAT mapping associated with an active TCP connection. The victim’s traffic is then redirected to the attacker, enabling session interception or hijacking.

A second scenario involves DNS. The attacker can interfere with a victim’s request, causing the legitimate response to be delivered to the attacker while sending the client a forged response.

NatJack can also be used to probe for exposed ports through the NAT’s external mappings. In a saturation attack, forged flows are injected until the available table space is exhausted. Legitimate clients can no longer establish new connections.

The impact therefore includes session hijacking, DNS spoofing, service exposure, and denial of service. Based on the information available as of August 7, 2026, there is no public evidence of exploitation in real-world attacks.

Vulnerabilities Identified in Linux and Windows

On Linux, the issue is tracked as CVE-2026-63913, with a CVSS score of 8.2, in the Netfilter conntrack module.

A specially crafted SYN packet followed by an RST packet with an invalid sequence number can prematurely transition an active NAT entry to the closed state. The conntrack logic does not correctly validate the direction of traffic.

The fixed stable releases are:

• 5.10.259
• 5.15.210
• 6.1.176
• 6.6.143
• 6.12.93
• 6.18.35
• 7.0.12
• 7.1

According to Stagg, the change fixes the flaw in the code but does not completely eliminate the broader downstream spoofing technique. The attack becomes more difficult, not impossible.

On Windows, CVE-2026-56181 affects the NAT used by Hyper-V and has a CVSS score of 8.3. The issue is classified as an origin-validation error that can be exploited from an adjacent network.

Affected versions include:

• Windows 11 24H2 before build 26100.8875;
• Windows 11 25H2 before build 26200.8875;
• Windows 11 26H1 before build 28000.2525;
• Windows Server 2025 before build 26100.33158.

Research Scope and Defensive Measures

Stagg conducted the analysis through SODIUM-24. Synack reports testing dozens of real network-infrastructure products from multiple vendors, with proof-of-concept demonstrations performed in controlled environments.

However, no complete product-by-product matrix is available. In addition to Windows and Linux, other NAT implementations may therefore be affected, but not all potentially vulnerable products have been publicly identified.

An earlier NDSS 2024 study had already demonstrated TCP hijacking through NAT mapping manipulation: 52 of 67 tested routers were vulnerable, and the analysis resulted in ten CVEs.

Administrators should:

• install the applicable updates for Linux and Windows;
• isolate untrusted workloads from trusted systems sharing the NAT;
• encrypt traffic, including within corporate networks;
• enable IP Source Guard, where available;
• avoid treating individual patches as a comprehensive fix for NatJack.

There is no single fix for this attack class. Segmentation and encryption remain necessary even after systems have been updated.