- Security researcher Malcolm Stagg has uncovered NatJack, a new class of attacks that exploits a fundamental design weakness in network address translation (NAT) implementations.
- The attacks can hijack active TCP sessions, expose internal network ports, spoof DNS responses, and crash network connectivity by overwhelming NAT tables.
- The attack affects both Windows and Linux systems, and Microsoft and Linux developers have fixed two of the implementation flaws. But researchers say patches do not eliminate the broader attack technique.
Security researcher Malcolm Stagg has unveiled a new class of cyberattacks that exploit a basic weakness in how networks manage internet traffic. Stagg presented the attack, which he called NatJack, at the Black Hat USA 2026 security conference.
They allow an attacker to hijack active internet connections and trick computers into visiting fake websites. It can also enable the attacker to crash a network’s ability to connect to the Internet.
The issue isn’t a single software bug. The researcher uncovered an issue in the design of network address translation (NAT), which is the fundamental principle underlying the ability for several machines to connect to the Internet via a single public IP address. The problem invalidates the fundamental assumption on which these networks are based.
How the Attack Works
Network address translation works like a reception desk in a large office building. Devices inside the network are like employees with internal extensions that can’t receive calls directly from outside.
Before a computer can visit a particular website, it needs to first send a request to the NAT device. The NAT device then opens a temporary door for that specific conversation to bring back the reply.
The NatJack research reveals that an attacker who has control of any device behind the same NAT box can exploit this system. They can trick the NAT device into mixing up the “doors” for different conversations. This broken trust model affects various independently developed systems, including Windows, Linux, and macOS implementations.
The research identified four main attack paths. One allows attackers to redirect an active TCP connection by changing its NAT mapping. Another method is a DNS attack wherein the attacker interferes with the victim’s DNS request.
In doing so, the attacker makes the legitimate DNS response reach him. Then he sends a forged response back to the victim. Other techniques can reveal the external ports assigned to a victim’s connection or flood the NAT connection table with fake entries, preventing legitimate users from creating new connections.
No Single Patch and Mixed Vendor Response
Two specific vulnerabilities highlight how serious this issue actually is. The first, the flaw CVE-2026-56181, affects Windows NAT on Hyper-V and carries a severity score of 8.3 out of 10.
The second vulnerability, CVE-2026-63913, targets Linux’s Netfilter conntrack and has a rating of 8.2. The Linux flaw happens because conntrack doesn’t actually check which way a packet is going, so it lets a rogue packet reset an otherwise valid connection.
Already, Microsoft has released updates for affected systems, Windows 11 24H2, 25H2, 26H1, and Windows Server 2025. Systems running builds older than the new releases with the patch require immediate updating. Linux developers have also released fixes in several stable kernel branches.
Stagg tested the techniques against dozens of products from 13 different vendors. He created 95 test reports and found that every implementation he tested remained vulnerable to some part of the attack. Yet, there is no single patch that will fix the broader attack class.
The kernel changes released for Linux and Windows only fix specific code flaws and increase the complexity of exploitation, but do not completely solve the underlying design issue.
Also, there’s already a fix for the vendor response. Cisco did not categorize the exploits as security vulnerabilities but as design limitations. Apple also did a similar thing with its macOS implementation, insisting it’s a known limitation, not a vulnerability.
Impact of the Attack and How to Prevent It
The attack is only successful if it gains privileged access to a system behind the same NAT as the victim. So, the main mitigation advice is to separate untrusted workloads from trusted systems that share NAT infrastructure.
Encrypting all traffic, even within internal networks, and applying available Windows and Linux updates is helpful too. Using IP Source Guard, wherever applicable, can add an extra layer of security.
Currently, there’s no evidence of any active NatJack exploits outside the lab. However, the research builds on a known history of NAT-state manipulation, including the study from NDSS 2024.
This study revealed that 52 out of 67 tested routers are vulnerable to the same attacks. This discovery challenges a longstanding security assumption. It also signals the need for network defenders to change how they view internal trust boundaries.
The growing demand for consumer control over data is reflected in recent FCC privacy rules, which require ISPs to obtain opt-in consent before sharing sensitive information like web browsing history, health data, and location.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Firefox Users on iOS Can Now Block Ads without an Extension
Mozilla is slowly rolling out a built-in ad blocker for Firefox on iPhones and iPads, no extension n...
Suspected Chinese Hackers Exploit Critical VMware vCenter Flaw Across 47 Countries
Several servers across 47 countries record a compromise via an exploit of Vmware vCenter directory-t...
WhatsApp Tests On-Device Scam Alert without Reading User Messages
WhatsApp is testing a new tool called Scam Alert that spots scam messages right on your phone. The t...
Apple Faces Lawsuit Over Claims that iCloud Private Relay Leaks User IP Addresses
A law firm sued Apple, saying its Private Relay tool did not protect user privacy as promised. Exper...
Hackers Exploit TrueConf Servers to Distribute Malware Through Fake Software Updates
A hacker group named Head Mare broke into TrueConf video meeting servers and swapped safe installers...
Germany Warns Companies Over Missing Security Contact Files on Most Websites
Germany’s cyber agency BSI wants every website to publish a security.txt file so researchers c...
