New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Security researcher Malcolm Stagg disclosed a new attack class called NatJack that exploits weaknesses in NAT implementations to hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. The attacks affect both Windows and Linux systems, with two specific vulnerabilities assigned CVEs: CVE-2026-56181 in Windows NAT used by Hyper-V and CVE-2026-63913 in Linux Netfilter conntrack. The technique requires an attacker with privileged access behind the same NAT as the victim and manipulates connection-tracking state to redirect or interfere with network traffic, highlighting a fundamental assumption flaw in NAT designs.

AI-extracted · verify before operational use