NatJack Attacks Expose Weakness in Network Address Translation

NatJack, a new class of attacks, targets an assumption in network address translation (NAT) that has been quietly doing its job for decades. This attack takes advantage of the fact that machines behind the same NAT can tamper with each other's connections.

Independent researcher Malcolm Stagg demonstrated this vulnerability at Black Hat USA 2026. He found four ways to abuse the NAT table: rewriting mappings on a live TCP connection, nudging DNS requests for forged replies, revealing external ports mapped by targets, and flooding tables with junk flows.

The attack does not require Layer 2 access or any action from the victim beyond being behind the same NAT. Stagg tested 32 products across dozens of configurations and found every one vulnerable to at least some of the techniques.

Windows, Linux, and macOS were all affected, despite sharing no NAT code at all. This suggests a shared assumption rather than a shared typo. Two implementations drew formal CVEs: CVE-2026-56181 in Windows Hyper-V and CVE-2026-63913 in Linux Netfilter's connection tracking.

Cisco and Apple declined to treat the findings as vulnerabilities, calling them known limitations of NAT and the transport layer. They argued that modern security models already assume local networks may be hostile.