Infrastructure Security Alert: "NatJack" Attacks Hijack TCP Sessions & Spoof DNS via NAT Table Manipulation
Executive Summary
Presented at Black Hat USA 2026 on August 7, 2026, security researcher Malcolm Stagg exposed a major new attack class dubbed "NatJack". The vulnerability class manipulates Network Address Translation (NAT) connection tracking (conntrack) tables across both Windows and Linux kernels, allowing local network attackers to hijack active TCP sessions, spoof DNS responses, and expose internal ports without administrative privileges. Assigned CVE-2026-56181 (Windows NAT) and CVE-2026-63913 (Linux Netfilter), NatJack flaws affect virtualized cloud environments, Docker/Hyper-V containers, and shared corporate Wi-Fi infrastructure.
Technical Analysis of the NatJack Attack Class
NatJack abuses state-tracking logic inside kernel-level NAT translation modules:
1. Connection Tracking State Manipulation Mechanics
The attack targets how NAT routers and virtual switches manage internal-to-external IP mappings:
* The Flaw: NAT implementations maintain state tables to map internal private IP/port pairs to public gateway endpoints. NatJack sends crafted outbound UDP/TCP packets with manipulated source port sequences, tricking the kernel into overriding existing translation entries.
* Session Hijacking: By overwriting active conntrack entries, the attacker forces the NAT gateway to route incoming external TCP packets—such as web or database responses—directly to the attacker's machine rather than the victim's.
2. DNS Spoofing & Port Exposure Vulnerabilities
Beyond session hijacking, NatJack enables silent traffic manipulation:
* DNS Response Forgery: Attackers overwrite outgoing DNS query mappings, injecting spoofed DNS responses to redirect victim web traffic to malicious phishing portals.
* Internal Port Exposure: Attackers force the NAT table to open inbound port mappings, exposing internal, un-routable service ports to external scanners.
Vulnerability Metric
Details
Vulnerability Class
NatJack (NAT Connection Tracking Manipulation)
CVE Identifiers
CVE-2026-56181 (Windows NAT, CVSS 8.3), CVE-2026-63913 (Linux Netfilter, CVSS 8.2)
Disclosed Venue
Black Hat USA 2026 (August 7, 2026)
Impacted Systems
Windows Hyper-V, Linux Kernel Netfilter / conntrack, Docker Networks
Primary Threat
Active TCP Session Hijacking, DNS Spoofing, Internal Port Exposure
The Risk of Shared Network Address Translation Boundaries
The discovery of NatJack highlights deep architectural weaknesses in shared NAT infrastructure. Because cloud hypervisors, container hosts, and corporate Wi-Fi gateways rely on deterministic connection tracking, an attacker sharing a local subnet can compromise adjacent virtual machines or employee workstations without breaking network-level encryption.
Zero-trust network architecture and end-to-end transport layer encryption are vital to mitigating NAT manipulation attacks.
Recommendations and Mitigations
Network engineers, cloud architects, and sysadmins must enforce strict defensive controls across NAT environments:
1. Apply Windows and Linux Kernel Security Patches: Update Windows builds to remediate CVE-2026-56181 and update Linux kernel Netfilter modules to resolve CVE-2026-63913.
2. Isolate Untrusted Workloads via Dedicated Subnets: Separate untrusted Docker containers, guest Wi-Fi networks, and tenant VMs into isolated VLANs with distinct NAT gateways.
3. Mandate End-to-End Transport Layer Security (mTLS / HTTPS): Enforce strict TLS encryption and certificate validation across all internal microservice and web communications to render hijacked TCP streams unreadable.
4. Deploy IP Source Guard & Anti-Spoofing Filters: Enable IP Source Guard and strict reverse-path forwarding (uRPF) on managed network switches to block forged IP/port combinations.