Black Hat 2026 Discloses NatJack: NAT Connection-Tracking Table Hijack Class Threatens All OSes
NatJack, disclosed at Black Hat USA 2026, achieves TCP session hijack and DNS poisoning by manipulating NAT connection-tracking tables. CVE-2026-56181 (Windows NAT/Hyper-V, CVSS 8.3) and CVE-2026-63913 (Linux Netfilter, CVSS 8.2) assigned. 13 vendors, 32 products affected. No complete patch exists.
Independent researcher Malcolm Stagg disclosed a new attack class, NatJack, at Black Hat USA 2026. Direct manipulation of NAT connection-tracking tables yields TCP session hijack, forged DNS responses, external mapped-port probing, and NAT-table exhaustion DoS. Tests covered 32 products/configs from 13 vendors. Windows, Linux, and macOS all affected. Linux and Windows implementations received CVE-2026-63913 and CVE-2026-56181 respectively. NatJack is rooted in the RFC assumption that co-NAT endpoints inherently trust each other. No complete fix exists.
Incident Overview
NatJack is not a single-vendor code defect. It is a systemic exploit of 1990s NAT design assumptions. NAT was built only to mitigate IPv4 exhaustion. Specs default to mutual trust among endpoints behind the same gateway; connection-tracking entries are not authenticity-checked. An attacker who obtains access inside the same NAT boundary—malicious container on a shared Kubernetes node, neighbor VM on the same cloud host, any device on an enterprise LAN—can interfere with arbitrary connections without the target host noticing.
Technical Details
Four Core Attack Paths
- TCP session hijack: based on RFC 1337 TIME-WAIT Assassination, send forged SYN+RST sequences to close the victim's live NAT entry early; attacker claims the freed slot and takes over the session;
- DNS poisoning: exhaust the victim's NAT entries with forged connections, pop pending DNS records, inject a forged mapping pointing at the attacker's host, then return forged DNS responses to the victim;
- Port probing: infer the victim's source ports from NAT table state; reconnaissance for follow-on attacks;
- NAT table exhaustion: flood the connection table with forged flows, starve legitimate new connections, DoS.
Two Implementation-Layer CVEs Assigned
CVE-2026-63913 (CVSS 8.2): Linux Netfilter conntrack missing direction validation. Attacker sends forged SYN plus RST with invalid sequence numbers to force live NAT entries into closed state. Fixed in kernel 5.10.259 / 5.15.210 / 6.1.176 / 6.6.143 / 6.12.93 / 6.18.35 / 7.0.12 / 7.1. Researcher notes the patch only increases attack complexity; it does not eliminate the NatJack attack surface.
CVE-2026-56181 (CVSS 8.3): Windows NAT source-validation error in Hyper-V. Affected versions: Windows 11 24H2 (< 26100.8875), 25H2 (< 26200.8875), 26H1 (< 28000.2525), and Windows Server 2025 (< 26100.33158). Patch primarily targets Azure Kubernetes Service workloads. Broader Windows NAT exposure remains incompletely addressed. macOS has no patch.
Impact Assessment
NatJack breaks the twenty-year industry assumption that NAT equals an internal boundary. Highest-risk scenarios:
- Shared Kubernetes nodes: multi-tenant containers share host NAT;
- Virtualization and multi-tenant cloud: neighbor VMs share a NAT egress;
- VDI and developer virtualization: untrusted code shares a gateway with production traffic;
- Enterprise LAN: any compromised internal device can laterally disrupt critical sessions.
No in-the-wild NatJack exploitation observed as of 2026-08-07. PoC code is public. Automated weaponization window will shrink fast. TLS stops payload readout of hijacked traffic. It does not stop session teardown or DNS redirection.
Remediation
Immediate Actions
- Deploy Linux kernel 5.10.259 / 5.15.210 / 6.1.176 / 6.6.143 / 6.12.93 / 6.18.35 / 7.0.12 / 7.1+ stable updates;
- Upgrade Windows 11/Server to latest cumulative updates covering CVE-2026-56181;
- Enable TLS on critical internal communications; enable DoH/DoT for internal DNS and pin resolvers.
Architectural Hardening
- Drop the legacy assumption that shared NAT equals a trusted boundary. Isolate workloads of different trust levels onto separate bridges/VLANs/hosts;
- Enable IP Source Guard on access switches to block L2 spoofed packet injection;
- Monitor NAT table saturation and anomalous connection resets as early NatJack signals;
- On macOS, temporarily keep untrusted devices off the same NAT boundary as critical sessions.
References
- The Hacker News: NatJack attack-class technical analysis
- ByteIota: NatJack 32-product test results
- Business Tech Weekly: CVE assignments and mitigations