Security researcher Malcolm Stagg has introduced a new attack technique called NatJack during Black Hat USA 2026. The attack targets the way Network Address Translation (NAT) devices manage active network connections. Instead of attacking a single product, NatJack affects a common design approach used in many NAT implementations. Researchers found vulnerable behavior in both Windows and Linux environments.
NatJack works by manipulating the connection-tracking information stored inside NAT devices. If an attacker already has privileged access to a device behind the same NAT as the victim, they may interfere with another user’s active network sessions. This can allow attackers to hijack TCP connections, spoof DNS responses, expose mapped ports, or even overload NAT tables and disrupt network communication.
The research shows that this is not a problem limited to one operating system, router, or firewall vendor. Testing identified vulnerable behavior across many independently developed NAT implementations, including routers, firewalls, cloud services, hypervisors, and container platforms. This makes NatJack a broader network security concern rather than a single software vulnerability.
Unlike traditional attacks such as ARP spoofing, NatJack does not require the attacker and victim to be on the same broadcast domain. The attack can still succeed even when systems are separated by VLANs or different subnets, as long as they share the same NAT infrastructure. This challenges the long-standing assumption that devices behind the same NAT cannot interfere with each other’s network state.
Researchers also identified two implementation-specific security flaws related to NatJack. These include CVE-2026-56181, affecting Windows NAT used by Hyper-V, and CVE-2026-63913, impacting Linux Netfilter conntrack. Both vulnerabilities have high severity scores, but they represent only specific implementation issues rather than the complete NatJack attack class.
The risk is considered highest in environments where trusted and untrusted systems share the same NAT infrastructure. Examples include enterprise networks, cloud platforms, Docker hosts, Kubernetes clusters, virtual machines, and serverless environments. Home routers may also be affected, although an attacker would generally need to control a device inside the same local network before attempting the attack.
There is currently no single patch that completely removes the broader NatJack attack technique because it targets common NAT design behavior. However, organizations are advised to install available Windows and Linux security updates, separate trusted and untrusted workloads, encrypt internal network traffic, and use protections such as IP Source Guard wherever possible. These measures can reduce the chances of successful exploitation.
The NatJack research highlights how long-standing assumptions about NAT security may no longer be reliable in modern environments. While no confirmed large-scale attacks using NatJack have been reported so far, security experts recommend that organizations begin strengthening their network defenses before attackers start weaponizing these techniques. The disclosure serves as an important reminder that shared network infrastructure can introduce security risks that were previously underestimated.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
