NatJack

NatJack — sharing a NAT table is a trust relationship nobody declared: five named primitives against NAT state, of which only the downstream TCP hijack got a CVE on each platform

Network address translation carries an assumption almost nobody has written down: that the devices sharing a NAT table are peers who can be trusted not to interfere with each other's entries. NatJack, presented by an independent researcher working with the Synack Red Team at Black Hat USA 2026, is a systematic attack on that assumption, and independent testing found every evaluated NAT implementation vulnerable to at least one of its primitives (Malcolm Stagg, 2026-08-06, Synack Red Team, 2026-08-06).

The research enumerates five named primitives. The first is the one that got the identifiers: "Certain network address translation (NAT) implementations allow downstream attackers to manipulate NAT table state entries in a manner that enables TCP session hijacking through downstream IP spoofing." An attacker sharing the NAT table removes or replaces the mapping for a victim's live TCP connection and redirects that traffic to itself, allowing impersonation, traffic injection, session termination and limited interception. The second is the same hijack coordinated with an attacker-controlled server upstream, which needs prior knowledge of the victim's externally mapped port — supplied conveniently by the fourth primitive, a disclosure of exactly that address and port. The third applies the mapping manipulation to DNS query and response pairs, and the fifth exhausts the NAT table outright.

Two CVEs were assigned, and the mapping between them and the flaws is explicit rather than inferred: both name the downstream-spoofing TCP hijack, one per platform. CVE-2026-56181 is Microsoft's, covering Windows NAT and affecting Hyper-V — Microsoft's own record describes an "Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network", scores it 8.3 and rates it Moderate, fixed in the July 2026 update across Windows Server 2025 and Windows 11 24H2 through 26H1 (Microsoft Security Response Center, 2026-07-14). CVE-2026-63913 is the Linux kernel's, where the announcement states that "An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number", addressed in 7.1 and seven stable and long-term point releases (Linux kernel CVE team, 2026-07-19).

Two qualifications change what patching actually buys, and both come from the researcher rather than from either vendor. The Linux change is not a fix: it is recorded as "CVE-2026-63913: Linux Kernel Netfilter (fixing a code flaw and applying a mitigation for the downstream spoofing attack) applied in Linux kernel 7.1 and higher. This is not a complete fix but does increase attack complexity." And on severity, where Microsoft attributed its moderate rating to the attack depending on ephemeral port allocations, the researcher's own rebuttal is that the proof of concept can cover the entire ephemeral port range in a matter of seconds — a direct challenge to that mitigating factor, and the researcher's claim rather than the vendor's.

That leaves an asymmetry worth being precise about. A defender who applies both updates has closed one of five primitives outright on Windows, raised its cost on Linux, and left the DNS hijack, the port disclosure and the table-exhaustion denial of service untouched on every platform, because they have no identifier and therefore nothing to apply. The precondition for all of them is unchanged: an attacker positioned downstream of the same NAT. Where that position exists in a public-sector estate is worth enumerating deliberately — a multi-tenant hypervisor host, a container node running workloads of different trust levels behind one bridge, a shared cloud egress gateway, a guest network sharing translation with a corporate one.

Detection, telemetry class first. The researcher's own recommendation is the practical one: monitor NAT-table utilisation for anomalous growth, which is the signal for the exhaustion primitive and often a precursor to mapping manipulation. Connection-tracking telemetry showing entries for established sessions transitioning to a closed state without an orderly teardown, or reappearing against a different internal address, is the shape of the hijack — and the Linux mechanism is specifically a reset packet carrying an invalid sequence number, which is itself the anomaly to look for. Permissive connection-tracking modes that accept out-of-window packets widen the window and are worth turning off where they are not required.