NatJack Attack Exposes Critical NAT Vulnerabilities
A new attack vector called NatJack can hijack TCP sessions and spoof DNS by manipulating NAT tables. This affects major platforms including Windows and poses serious risks to enterprise networks.
TL;DR
- Security researcher Malcolm Stagg revealed NatJack, a novel attack exploiting NAT implementations.
- The vulnerability allows session hijacking, DNS spoofing, port exposure, and NAT table exhaustion.
- Affects multiple independent systems including Windows; disclosed at Black Hat USA 2026.
- Organizations should audit their NAT infrastructure for susceptible behaviors.
- Mitigation requires updating firmware and reviewing firewall/NAT configurations.
A newly disclosed attack technique called NatJack targets the core of modern networking infrastructure by exploiting how devices handle Network Address Translation (NAT). Discovered by security researcher Malcolm Stagg and presented at Black Hat USA 2026, NatJack enables attackers to hijack active TCP connections, forge DNS responses, reveal internal port mappings, and overwhelm NAT connection tables.
This attack impacts a wide range of systems due to flawed handling of NAT state across different vendors’ implementations. Notably, widely used platforms such as Microsoft Windows were found to exhibit vulnerable behavior, raising concerns for organizations relying on these systems for secure communications.
How NatJack Works
- NatJack abuses predictable patterns in how NAT devices track and manage connection states.
- By injecting crafted packets, attackers can trick NATs into believing a new session is part of an existing one.
- This allows unauthorized parties to take over legitimate TCP streams without requiring man-in-the-middle positioning.
- DNS spoofing becomes possible when attackers manipulate cached NAT entries to redirect traffic.
Impact and Mitigation Strategies
- Enterprises using affected NAT implementations risk data interception, service disruption, and lateral movement.
- Vulnerable systems include consumer routers, enterprise firewalls, and operating systems like Windows.
- Organizations should review vendor advisories and apply patches or firmware updates where available.
- Network segmentation and monitoring tools can help detect unusual NAT table activity or unexpected session hijacking attempts.
- Long-term fixes require vendors to redesign how they maintain and validate NAT connection tracking logic.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.