Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

NatJack NAT-state attack research and proof-of-concept exploitation

Technical Analysis
First reported
Last updated
Happening score
H score 21
1 unique sources, 1 articles

Summary

Hide ▲

NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increasing risk across systems that share the same translation boundary. The findings show affected behavior in Windows and Linux, with concrete implementation flaws tracked as CVE-2026-56181 and CVE-2026-63913. The research matters because it turns an assumed trust boundary inside NAT infrastructure into a practical path for traffic manipulation and denial of service.

Related Happenings

Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)

Vulnerability
H score23 First: 07.08.2026 12:32 Last: 07.08.2026 12:32 Sources 1

How related: For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because the conntrack logic failed to validate its direction.

About this happening: CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for af...

Open Happening

NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)

Vulnerability
H score23 First: 07.08.2026 11:52 Last: 07.08.2026 11:52 Sources 1

How related: Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.

About this happening: NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigne...

Open Happening

Calypso telecommunications espionage campaign using Showboat and JFMBackdoor

Campaign
H score36 First: 21.05.2026 17:00 Last: 21.05.2026 17:00 Sources 1

About this happening: A Calypso / Red Lamassu espionage campaign is targeting telecommunications providers with new Showboat and JFMBackdoor malware, increasing the risk of long-term co...

Open Happening

APT28 FrostArmada DNS hijacking and AitM credential theft campaign

Campaign
H score45 First: 07.04.2026 18:51 Last: 07.04.2026 18:51 Sources 1

About this happening: A multinational disruption effort has taken down FrostArmada, an APT28 campaign that hijacked router DNS settings to steal Microsoft account credentials and OAuth toke...

Open Happening

Timeline

  1. 07.08.2026 12:32 2 articles · 7h ago

    NatJack disclosure reveals NAT session hijacking and spoofing risks

    Initial Disclosure

    Security researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026, describing a new attack class that manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Microsoft and kernel.org records identify CVE-2026-56181 in Windows NAT used by Hyper-V and CVE-2026-63913 in Linux Netfilter conntrack, and the mitigation guidance calls for separating untrusted workloads from trusted systems that share NAT infrastructure, applying available Windows and Linux updates, encrypting traffic inside internal networks, and using Internet Protocol (IP) Source Guard where applicable.

    Show sources
    Open in new tab