NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)
Vulnerability
Summary
Hide ▲
Show ▼
NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigned CVE-2026-56181 and CVE-2026-63913 to the affected implementations, turning the attack class into a concrete vulnerability target. The issue affects systems that share NAT infrastructure across Windows and Linux environments, especially where untrusted workloads can manipulate connection state. Available updates reduce risk, but the broader attack class still needs isolation and traffic-protection controls.
Related Happenings
NatJack NAT-state attack research and proof-of-concept exploitation
Technical Analysis
H score21
First: 07.08.2026 12:32
Last: 07.08.2026 12:32
Sources 1
How related:
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening:
NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
NatJack NAT-state attack research and proof-of-concept exploitation
Technical AnalysisHow related: Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening: NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)
Vulnerability
H score23
First: 07.08.2026 12:32
Last: 07.08.2026 12:32
Sources 1
How related:
For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because the conntrack logic failed to validate its direction.
About this happening:
CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for af...
Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)
VulnerabilityHow related: For Linux, the kernel.org CNA record says a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active Netfilter NAT entry into a closed state because the conntrack logic failed to validate its direction.
About this happening: CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for af...
Warlock ransomware post-exploitation tooling upgrades
Malware Activity
H score38
First: 17.03.2026 17:36
Last: 17.03.2026 17:36
Sources 1
About this happening:
The Warlock ransomware group has upgraded its post-exploitation toolset with BYOVD, TightVNC, and Yuze, making intrusions harder to detect and interrupt. In an obs...
Warlock ransomware post-exploitation tooling upgrades
Malware ActivityAbout this happening: The Warlock ransomware group has upgraded its post-exploitation toolset with BYOVD, TightVNC, and Yuze, making intrusions harder to detect and interrupt. In an obs...
Timeline
-
07.08.2026 11:52 3 articles · 3h ago
Malcolm Stagg discloses NatJack NAT state-manipulation attack class
Initial DisclosureSecurity researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026, describing a NAT state-manipulation attack class that can hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables across Windows, Linux, macOS, virtualization, containerization, and cloud infrastructure. The research assigned CVE-2026-56181 to Windows NAT used by Hyper-V and CVE-2026-63913 to Linux Netfilter conntrack, and it recommends workload separation, traffic encryption, and IP Source Guard where applicable.
Show sources
- Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access — thehackernews.com — 07.08.2026 11:52
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32
-
07.08.2026 11:52 3 articles · 3h ago
Malcolm Stagg discloses NatJack NAT state-manipulation attack class
Initial DisclosureSecurity researcher Malcolm Stagg disclosed NatJack at Black Hat USA 2026, describing a NAT state-manipulation attack class that can hijack active TCP sessions, spoof DNS responses, disclose victim IP addresses and mapped ports, and exhaust NAT tables across Windows, Linux, macOS, virtualization, containerization, and cloud infrastructure. The research assigned CVE-2026-56181 to Windows NAT used by Hyper-V and CVE-2026-63913 to Linux Netfilter conntrack, and it recommends workload separation, traffic encryption, and IP Source Guard where applicable.
Show sources
- Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access — thehackernews.com — 07.08.2026 11:52
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32