Technical disclosures published during Black Hat 2026 have exposed a novel attack class that manipulates network address translation connection states across major operating system kernels. The technique permits an attacker controlling a system behind a shared network address translation boundary to hijack active TCP connections and spoof DNS responses.
The research details NatJack vulnerabilities CVE-2026-56181 in Windows Hyper-V NAT and CVE-2026-63913 in Linux Netfilter conntrack. By sending specialized SYN and RESET packet sequences with invalid sequence numbers, an attacker forces connection tracking modules to prematurely close active state table entries. This enables the adversary to replace translation mappings, redirect active TCP data streams, and intercept DNS resolution requests to return forged IP responses without generating standard perimeter alert logs.
Manipulating shared network address translation tables undermines isolation assumptions within container hosts and enterprise networks. If an adversary gains access to a low-privileged system or virtual machine sharing a network gateway, they can intercept sensitive internal transit traffic, manipulate domain name resolution, and exhaust gateway connection tables.
– Apply security updates released by Microsoft and Linux kernel maintainers across container hosts and hypervisors immediately.
– Segment untrusted workloads and guest virtual machines onto isolated network segments with dedicated network gateway mappings.
– Enforce IP Source Guard and strict anti-spoofing policies across internal network switch tiers.
– Enforce transport layer encryption for internal application traffic to protect data integrity against transport spoofing.
Network layer security relies on strict state validation within transport tracking modules combined with mandatory network microsegmentation to ensure shared translation gateways cannot be subverted for traffic interception. #CodeDefence #NatJack #NetworkSecurity #DNSHijacking #HyperV #LinuxKernel #AppSec #InfraSec
/
