UPDATE — NatJack's upstream-spoofing primitive now has its own identifier: CVE-2026-56179 ships ISN randomisation for Windows NAT, disabled by default and enabled only by a registry key
UPDATE · originally covered NatJack — sharing a NAT table is a trust relationship nobody declared: five named primitives against NAT state, of which only the downstream TCP hijack got a CVE on each platform (2026-08-10)
the original entry recorded two assigned identifiers and said the remaining primitives carried none. A third has since been published, and it changes what an operator has to do rather than only what the record says.
Microsoft published CVE-2026-56179 on 2026-08-11 — one day after the original entry — covering the primitive the research describes as the TCP session hijack coordinated with an upstream attacker-controlled server. Microsoft's description of it is an origin-validation error in Windows Network Address Translation allowing an unauthorised attacker to spoof over an adjacent network, rated Moderate with a base score of 8.3 and recorded as not exploited in the wild (Microsoft Security Response Center, 2026-08-11). The researcher's own CVE list now enumerates three identifiers and maps each to a specific configuration: CVE-2026-56181 to Windows NAT in a downstream-spoofing configuration, CVE-2026-56179 to Windows NAT in an upstream-spoofing configuration, and CVE-2026-63913 to Linux kernel netfilter (Malcolm Stagg, 2026-08-24).
The part that matters operationally is the shape of the Windows fix. The researcher records that the two Windows mitigations arrived in different monthly updates and behave differently: the July 2026 update for CVE-2026-56181 disables loose connection handling by default, while the August 2026 update for CVE-2026-56179 adds initial-sequence-number randomisation that is shipped off — "It is disabled by default and can be enabled via a registry key" (Malcolm Stagg, 2026-08-24). A Hyper-V host that took the August update and nothing else therefore still accepts the spoofed handshakes the primitive depends on. This is the inverse of the usual patch assumption, and it is the reason a vulnerability-management scan that reports the update as installed will read as compliant while the exposure is intact.
Nothing else in the original entry changes: the Linux change remains a partial mitigation that raises attack complexity rather than a complete fix, and the DNS-response hijack, external-mapping disclosure and NAT-table-exhaustion primitives still carry no identifier.
CVE-2026-56179: Microsoft Windows NAT (affecting Hyper-V in an upstream spoofing configuration)
CVE-2026-56179 patch provides ISN randomization to help prevent spoofed handshakes. It is disabled by default and can be enabled via a registry key.
Defender actions
- On Hyper-V hosts using a NAT virtual switch, install the August 2026 Windows security update and then explicitly enable the ISN-randomisation mitigation for Windows NAT via the registry key Microsoft's advisory names — the update ships it disabled, so patched hosts remain exposed to the upstream-spoofing hijack until it is switched on.
ATT&CK mapping
1 technique mapped from the cited reporting · MITRE ATT&CK v19.2
Credential Access TA0006
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Collection TA0009
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.