Ethical Hacking News
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
A new attack class called NatJack has been discovered, which manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. To mitigate this vulnerability, organizations should apply available Windows and Linux updates, encrypt traffic, and implement Internet Protocol Source Guard where applicable.
The NatJack attack manipulates NAT tables to hijack active TCP sessions, spoof DNS responses, and expose mapped ports.A new vulnerability (CVE-2026-56181 in Windows NAT used by Hyper-V and CVE-2026-63913 in Linux Netfilter conntrack) has been discovered that can be exploited for NatJack attack.The attack requires privileged access to a system behind the same NAT as the victim, allowing the attacker to manipulate connection-tracking entries.Four main paths are available to exploit this vulnerability: (1) redirecting traffic from an active TCP connection, (2) interfering with DNS requests, (3) exposing externally mapped ports or filling NAT tables with spoofed flows, and (4) exploiting assumptions about host behavior behind the same NAT.The researchers recommend mitigating measures include IP Source Guard and separating untrusted workloads from trusted systems that share NAT infrastructure.
The cybersecurity landscape is ever-evolving, with new threats emerging on a daily basis. In recent times, researchers have been working tirelessly to identify vulnerabilities in various systems, including network address translation (NAT) connection state. A recent breakthrough in this area has led to the discovery of a new attack class called NatJack, which manipulates NAT tables to hijack active TCP sessions, spoof DNS responses, and expose mapped ports.
The researchers behind the NatJack attack, led by security expert Malcolm Stagg, have presented their findings at Black Hat USA 2026. The research team has identified two implementation-specific flaws, CVE-2026-56181 in Windows NAT used by Hyper-V, and CVE-2026-63913 in Linux Netfilter conntrack, which can be exploited to take advantage of the NatJack attack.
The NatJack attack requires an attacker to have privileged access to a system behind the same NAT as the victim. This allows the attacker to manipulate connection-tracking entries belonging to another system, effectively hijacking the victim's TCP session. The researchers have identified four main paths that attackers can use to exploit this vulnerability.
The first path involves redirecting traffic from an active TCP connection by replacing its NAT mapping. This allows the attacker to intercept and alter the communication between the victim's application and the server. The second path interferes with a victim's DNS request, allowing the legitimate DNS response to reach the attacker, who can then send a forged response back.
The third path exposes externally mapped ports or fills the NAT connection table with spoofed flows until legitimate clients cannot create new connections. This makes it difficult for the victim to establish a new TCP session, leaving them vulnerable to further attacks.
Finally, the fourth path exploits the assumption built into many NAT implementations that hosts behind the same NAT are generally assumed not to manipulate one another's connection state. By manipulating this connection state, an attacker can gain unauthorized access to sensitive information or take control of the victim's system.
The researchers have tested the NatJack techniques against dozens of real-world network infrastructure products from multiple vendors and demonstrated proof-of-concept exploitation in a controlled environment. However, it is worth noting that there is no single patch for the broader attack class, and organizations should apply available Windows and Linux updates and encrypt traffic even within internal networks.
The researchers recommend Internet Protocol (IP) Source Guard where applicable to mitigate this vulnerability. Additionally, they suggest separating untrusted workloads from trusted systems that share NAT infrastructure, as this can help prevent the NatJack attack from being successful.
This latest discovery highlights the importance of staying vigilant in the ever-evolving cybersecurity landscape. As new threats emerge, it is essential for organizations and individuals to stay informed and take proactive measures to protect themselves.
Related Information:
https://www.ethicalhackingnews.com/articles/New-NatJack-Attacks-Hijack-TCP-Sessions-and-Spoof-DNS-by-Manipulating-NAT-Tables-ehn.shtml
https://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.html
https://nvd.nist.gov/vuln/detail/CVE-2026-56181
https://www.cvedetails.com/cve/CVE-2026-56181/
https://nvd.nist.gov/vuln/detail/CVE-2026-63913
https://www.cvedetails.com/cve/CVE-2026-63913/
Published: Fri Aug 7 05:07:05 2026 by llama3.2 3B Q4_K_M
