NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS (CVE-2026-56181, CVE-2026-63913)

NatJack: NAT Connection-Tracking Manipulation Attacks Hijack (TL-2026-1927), also tracked as NatJack, is a high-severity software vulnerability scored CVSS 8.3, first published 2026-08-07. It has no confirmed attribution, affects Microsoft Windows NAT (Hyper-V), references 2 CVEs (CVE-2026-56181, CVE-2026-63913), maps to 12 MITRE ATT&CK techniques (T1018, T1040, T1046), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-1927

Threat ID
TL-2026-1927
Also known as
NatJack
Severity
HIGH
CVSS
8.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-07
Last reviewed
2026-08-07
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
cloudservices, enterpriseit, telecoms, government administration, technology
Target regions
Global
Detection rules
9
Indicators of compromise
12
Updates
2026-08-07 · revalidated 1× · latest source

Independent researcher Malcolm Stagg (Synack Red Team) disclosed NatJack at Black Hat USA 2026, a class of attacks that manipulates Network Address Translation (NAT) connection-tracking state to hijack active TCP sessions, poison DNS responses, enumerate NAT-assigned connection ports, and exhaust NAT tables for denial of service. Every one of 32 tested products/configurations from 13 notified vendors was vulnerable to some or all techniques; CVE-2026-56181 covers Windows NAT/Hyper-V and CVE-2026-63913 covers Linux Netfilter conntrack. No public evidence of in-the-wild exploitation as of disclosure.

How NatJack: NAT Connection-Tracking Manipulation Attacks Hijack works

NatJack is a research-disclosed class of network-infrastructure attacks, presented by Malcolm Stagg (independent researcher and Synack Red Team member) in the Black Hat USA 2026 talk 'Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructure' (Oceanside D, August 6, 2026, 10:15-10:45am PT). The research is the product of roughly three years of independent investigation and targets a decades-old design assumption baked into NAT/connection-tracking implementations: that devices sharing a NAT table can trust one another. That assumption held while networks operated cooperatively but breaks down under adversarial conditions, letting an attacker who merely shares a NAT boundary with a victim (adjacent-network position, no IP spoofing or broadcast-domain access required in the classic Layer 2 sense) manipulate connection-tracking state directly.

Stagg documents four distinct techniques: (1) TCP connection hijacking, which forces a victim's tracked connection into a closed state using spoofed packets and then substitutes the resulting NAT table entry with one pointing at the attacker, leveraging the RFC 1337 TIME-WAIT Assassination mechanism to complete the takeover in a minimal number of packets; (2) DNS response poisoning, which intercepts and modifies UDP DNS responses traversing the NAT to silently redirect victim lookups; (3) NAT table exhaustion, which floods the shared NAT/conntrack table until it fills, breaking connectivity for every device sharing that NAT (denial of service); and (4) connection port identification, which determines which port a NAT assigned to an active connection and underpins the other three techniques. Because the manipulation happens at Layers 3-4 inside the NAT/connection-tracking state machine, it bypasses Layer 2 isolation controls such as VLAN segmentation and switch port isolation that defenders typically rely on to separate mutually-untrusting hosts. Stagg has described discovering the flaw accidentally, noting he began 'noticing that I was sometimes getting responses that didn't correspond to the packets that I was sending.'

Two CVEs were assigned as of disclosure. CVE-2026-56181 (CVSS 3.1: 8.3, AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, CWE-346 Origin Validation Error) affects Windows NAT in Hyper-V: an origin-validation failure lets an unauthorized attacker on an adjacent network spoof traffic into the NAT/Hyper-V connection-tracking path. It is fixed in Windows 11 24H2 (10.0.26100.8875+), 25H2 (10.0.26200.8875+), 26H1 (10.0.28000.2525+), and Windows Server 2025 (10.0.26100.33158+). CVE-2026-63913 (CVSS 3.1: 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) affects the Linux kernel's Netfilter conntrack TCP state machine (net/netfilter/nf_conntrack_proto_tcp.c): the module fails to validate packet direction when processing RST packets, letting a crafted RST with an invalid sequence number force a tracked connection into CLOSE state prematurely and open its NAT slot for hijack or reuse. The flaw has existed since kernel 2.6.15 and is fixed in 5.10.259+, 5.15.210+, 6.1.176+, 6.6.143+, 6.12.93+, 6.18.35+, 7.0.12+, and 7.1+; the fix was expedited in part at Microsoft Azure Kubernetes Service's request given AKS's reliance on Linux conntrack for pod/service networking.

Across the 95 vulnerability reports Stagg filed with 13 vendors covering 32 products/configurations, every tested NAT implementation was vulnerable to at least one NatJack technique, spanning Windows, Linux, and macOS. Not every vendor accepted the CVE-worthy framing: Cisco PSIRT classified the findings against Secure Firewall and IOS XE as 'design-level NAT limitations rather than security vulnerabilities' while still publishing documented mitigations for both product lines, and Apple stated the behavior 'reflects a known limitation of the transport layer rather than a vulnerability,' with no CVE assigned to macOS as of disclosure. FreeBSD's NAT stack is fixed as of FreeBSD 15.0. Synack CTO Mark Kuhr framed the research's significance as showing 'why effective security testing must challenge long-held design assumptions, not only search for familiar software flaws.'

Synack's published mitigation guidance emphasizes detection over pure patching given the mixed vendor response: monitor for full or near-full NAT/conntrack tables, wide-range packet floods, duplicate source IPs observed from two network locations behind the same NAT, and anomalous SYN/RST sequences; enable IP Source Guard to block spoofed-source packets; segment untrusted traffic away from trusted traffic rather than sharing a NAT boundary across trust zones; cap per-client concurrent connections (Synack suggests roughly 10,000) to blunt table-exhaustion DoS; disable loose connection-tracking modes, port preservation, and endpoint-independent mapping where not required; restrict container/Kubernetes workloads' shared NAT-gateway access and isolate cloud workloads per NAT gateway; and rely on end-to-end TLS so that on-path NAT-table manipulation cannot silently alter application data even if session hijack succeeds.

MITRE ATT&CK techniques used in TL-2026-1927

Discovery

T1018 Remote System Discovery; T1040 Network Sniffing; T1046 Network Service Discovery

Impact

T1499.001 Endpoint Denial of Service: OS Exhaustion Flood; T1499.002 Endpoint Denial of Service: Service Exhaustion Flood; T1499.004 Endpoint Denial of Service: Application or System Exploitation; T1565.002 Data Manipulation: Transmitted Data Manipulation

Credential Access

T1557 Adversary-in-the-Middle

Reconnaissance

T1590 Gather Victim Network Information; T1590.005 Gather Victim Network Information: IP Addresses

defense-impairment

T1599 Network Boundary Bridging; T1599.001 Network Boundary Bridging: Network Address Translation Traversal

Affected products and versions in NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

  • Microsoft — Windows NAT (Hyper-V)
    Vulnerable versions: Windows 11 24H2 before 10.0.26100.8875; Windows 11 25H2 before 10.0.26200.8875; Windows 11 26H1 before 10.0.28000.2525; Windows Server 2025 before 10.0.26100.33158
    Fixed in: Windows 11 24H2 10.0.26100.8875+; Windows 11 25H2 10.0.26200.8875+; Windows 11 26H1 10.0.28000.2525+; Windows Server 2025 10.0.26100.33158+
  • Linux Kernel — Netfilter conntrack (net/netfilter/nf_conntrack_proto_tcp.c)
    Vulnerable versions: 2.6.15 up to versions below the fixed point releases
    Fixed in: 5.10.259+; 5.15.210+; 6.1.176+; 6.6.143+; 6.12.93+; 6.18.35+; 7.0.12+; 7.1+
  • Apple — macOS NAT / PF
    Vulnerable versions: Current macOS releases exhibit the underlying behavior; no CVE assigned
    Fixed in: None planned as of disclosure — Apple classifies this as a transport-layer design limitation, not a vulnerability
  • Cisco — Secure Firewall / IOS XE NAT
    Vulnerable versions: Current NAT implementations exhibit the underlying behavior; Cisco disputes CVE-worthy classification
    Fixed in: No code fix — Cisco PSIRT published configuration-based mitigation guidance for Secure Firewall and IOS XE
  • FreeBSD Project — FreeBSD NAT (pf/ipfw)
    Vulnerable versions: Before 15.0
    Fixed in: 15.0 and later

Remediation for NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

Patches

  • Microsoft cumulative update delivering builds 10.0.26100.8875+ / 10.0.26200.8875+ / 10.0.28000.2525+ / 10.0.26100.33158+ (CVE-2026-56181)
  • Linux kernel stable fixes to net/netfilter/nf_conntrack_proto_tcp.c across 5.10.259+/5.15.210+/6.1.176+/6.6.143+/6.12.93+/6.18.35+/7.0.12+/7.1+ (CVE-2026-63913)
  • FreeBSD 15.0 and later

Immediate actions

  • Apply Microsoft's fixed Windows builds for CVE-2026-56181: 10.0.26100.8875+ (24H2), 10.0.26200.8875+ (25H2), 10.0.28000.2525+ (26H1), 10.0.26100.33158+ (Windows Server 2025)
  • Upgrade Linux kernels to the fixed point releases for CVE-2026-63913: 5.10.259+, 5.15.210+, 6.1.176+, 6.6.143+, 6.12.93+, 6.18.35+, 7.0.12+, or 7.1+
  • Enable IP Source Guard on switches/routers bordering any shared NAT boundary to block spoofed-source packets
  • Apply Cisco PSIRT's published mitigation guidance for Secure Firewall and IOS XE NAT deployments (Cisco has not issued a patch, treating this as a design limitation)

Workarounds

  • Monitor NAT/conntrack table utilization for near-full or anomalous fill-rate conditions
  • Alert on anomalous SYN/RST sequence patterns and on duplicate source IPs observed from two network locations behind the same NAT
  • Apply Cisco Secure Firewall / IOS XE configuration-based mitigations where a code fix is not offered
  • No patch is planned for macOS; Apple characterizes the behavior as an inherent transport-layer limitation rather than a vulnerability

Longer-term hardening

  • Segment untrusted or multi-tenant clients onto dedicated NAT boundaries instead of sharing NAT/conntrack state across trust zones
  • Disable loose connection-tracking modes, port preservation, and endpoint-independent mapping on NAT/conntrack devices where not operationally required
  • Cap per-client concurrent connections (Synack recommends roughly 10,000) to blunt NAT-table exhaustion denial of service
  • Restrict container and Kubernetes workloads' shared NAT-gateway access; isolate cloud workloads behind per-tenant NAT gateways
  • Enforce end-to-end TLS so on-path NAT-table manipulation cannot silently alter or redirect application data even if a session is hijacked

CVEs associated with NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

CVE-2026-56181, CVE-2026-63913

Weaknesses (CWE) in NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

CWE-346

Timeline of NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

  • Microsoft ships CVE-2026-56181 fix same-day as CVE publication via July 2026 Patch Tuesday (KB5101650 for Windows 11 24H2/25H2, KB5101649 for 26H1).
  • CVE-2026-56181 (Windows NAT/Hyper-V origin validation error, CVSS 8.3) published to NVD.
  • Linux kernel netfilter conntrack fix for CVE-2026-63913 lands in stable branches; maintainers had initially dismissed Stagg's report as 'totally bogus' before confirming and fixing it, reportedly expedited at Microsoft's request to support Azure Kubernetes Service.
  • CVE-2026-63913 (Linux Netfilter conntrack RST-induced premature CLOSE, CVSS 8.2) published to NVD.
  • CVE-2026-63913 NVD record last modified with additional stable-kernel fix references.
  • Cisco PSIRT classifies findings against Secure Firewall/IOS XE as design-level NAT limitations rather than vulnerabilities while publishing mitigations; Apple states the behavior is a known transport-layer limitation and assigns no CVE.
  • Network World publishes 'NatJack at Black Hat: A new way to crack NAT's trust gap,' detailing the four attack techniques and vendor responses.
  • GlobeNewswire distributes 'New NatJack Research Exposes Design Weaknesses Across Major NAT Implementations,' republished by StreetInsider and IT Business Net, detailing the 13-vendor/32-product/95-report disclosure scope.
  • Synack publishes its Black Hat 2026 recap blog plus same-day NatJack mitigation guidance, including CTO Mark Kuhr's statement on design-assumption testing.
  • Malcolm Stagg presents 'Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructure' at Black Hat USA 2026 (Oceanside D, Level 2), publicly disclosing NatJack.
  • GBHackers on Security publishes coverage of the NatJack disclosure, naming AWS NAT Gateway/NLB hardening and SODIUM-24, LLC as additional disclosure details.

Update history for TL-2026-1927

Sources cited for NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

Threats related to NatJack: NAT Connection-Tracking Manipulation Attacks Hijack

Detection coverage for TL-2026-1927

As of 2026-08-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1927 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats