What Happened
Security researcher Malcolm Stagg disclosed a new attack class named NatJack at Black Hat USA 2026. NatJack manipulates NAT connection-tracking state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables — all from a position sharing the same NAT boundary as the target, without requiring the same broadcast domain or VLAN.
Testing identified vulnerable behavior across 32 products and configurations spanning routers, firewalls, cloud services, container platforms, and hypervisors, built on independently developed NAT implementations for both Windows and Linux. One confirmed flaw, tracked as CVE-2026-56181 with a CVSS score of 8.3, affects Windows NAT as used by Hyper-V. A related weakness with a CVSS score of 8.2 affects the Linux Netfilter connection-tracking subsystem. Exploitation requires privileged access to a system sharing NAT infrastructure with the victim.
Why This Matters for Canadian Organizations
NAT sits behind nearly every enterprise network boundary in Canada, from small business routers to carrier-grade infrastructure used by internet service providers and cloud hosts. Multi-tenant environments — shared hosting, container platforms, and cloud services where separate customers or workloads sit behind common NAT infrastructure — face the highest exposure, since NatJack assumes systems sharing a NAT boundary trust each other’s connection state by default.
Federally regulated financial institutions and government departments running virtualized infrastructure under Hyper-V or Linux-based container platforms should treat this disclosure as relevant to OSFI Guideline B-13 operational resilience assessments and to broader network segmentation reviews under CCCS guidance. Managed service providers and hosting companies serving Canadian clients need to assess whether tenant isolation assumptions built into their NAT architecture still hold given this new technique.
What to Do
Review NAT architecture for any environment where untrusted or lower-trust workloads share a NAT boundary with trusted systems, and separate them onto distinct NAT infrastructure where feasible. Apply vendor patches for CVE-2026-56181 and related Linux Netfilter fixes as they become available, and monitor connection-tracking tables for unexpected entry manipulation. Full technical details are available from The Hacker News.
