New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
- ID
- 11880
- Status
- summarized
- Published
- 07 Aug 2026, 6:58 PM
- Fetched
- 07 Aug 2026, 9:51 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 07 Aug 2026, 9:55 PM
- Tags
- Audience
- developersdatabase_learners
What happened
Security researcher Malcolm Stagg disclosed NatJack, a new attack class presented at Black Hat USA 2026 that manipulates NAT connection-tracking state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Two CVEs were assigned: CVE-2026-56181 (CVSS 8.3) in Windows NAT used by Hyper-V and CVE-2026-63913 (CVSS 8.2) in Linux Netfilter conntrack, with patches available for both.
Why it matters
If you run multi-tenant workloads behind shared NAT (e.g., Hyper-V VMs or Linux containers on the same host), apply the Windows and Linux updates now and stop assuming hosts behind the same NAT cannot interfere with each other's connections. The attack requires privileged access on a system behind the same NAT, so isolate untrusted workloads from trusted systems sharing NAT infrastructure and encrypt internal traffic rather than relying on NAT boundaries for trust.
Discussion angle
Whether your current cloud or on-prem architecture treats same-NAT hosts as implicitly trusted, and what it costs to segment workloads or encrypt internal traffic given that assumption is now broken.