NatJack exposes NAT trust flaw, lets co-tenant hijack sessions and spoof DNS
At Black Hat USA 2026, Synack Red Team researcher Malcolm Stagg unveiled NatJack, a new class of attacks that manipulates NAT connection‑tracking tables to hijack TCP flows, spoof DNS replies, expose mapped ports, and exhaust NAT tables. The techniques affect Windows Hyper‑V NAT and Linux Netfilter, earning CVE‑2026‑56181 and CVE‑2026‑63913, and force organizations to isolate untrusted workloads and encrypt traffic.