Security researcher Malcolm Stagg unveiled a new attack category called NatJack that exploits network address translation (NAT) state to intercept active TCP sessions, forge DNS responses, reveal victim IP addresses and mapped ports, and exhaust NAT tables. At Black Hat USA 2026, Stagg demonstrated these techniques across various network infrastructure devices, virtualization platforms, container environments, and cloud architectures, including Windows, Linux, and macOS implementations. Two specific flaws have been assigned CVEs: CVE-2026-63913 in the Linux Netfilter conntrack implementation and CVSS score: 8.3 in the Hyper-V NAT system used by Windows.
No universal fix exists for this broad category of attacks; organizations must deploy current Windows and Linux patches, as well as secure network traffic internally.
The NatJack research, conducted independently by Stagg through SODIUM-24, examines an assumption commonly made in many NAT implementations: hosts behind the same NAT are generally assumed not to interact with one another's connection states. Additionally, this research addresses vulnerabilities such as IP/port disclosure attacks and denial-of-service assaults targeting NAT state mechanisms. The crafted SYN packet with an invalid sequence number can prematurely close an active Netfilter NAT entry on Linux due to conntrack logic failure.
Affected versions include Windows 11 24H2 prior to version 26100.8875, Windows 10 25H2 before 26200.8875, Windows Server 2023 26H1 prior to 28000.2525, and Windows Server 2025 prior to version 26100.33158.
