New TCP Hijacking Flaw Exposed in Network Translation Systems
A new class of attack called NatJack can hijack active TCP sessions, spoof DNS responses, expose mapped ports, and even exhaust NAT tables by manipulating network address translation state. Presented at Black Hat USA 2026 by security researcher Malcolm Stagg, the findings reveal that multiple independently developed NAT implementations—including Windows—are vulnerable to the technique, raising concerns about the reliability of widely trusted network translation systems.
How the Attack Works
NatJack exploits the way NAT maintains connection state to rewrite or intercept traffic. By injecting crafted packets that alter the NAT table entries, an attacker can take over established TCP sessions without needing to break encryption or crack passwords. The technique also enables DNS spoofing by redirecting domain lookups through manipulated NAT mappings, and it can expose internal ports that should remain hidden behind the translation layer.
Scope and Impact
Because NatJack affects NAT behavior across different implementations, the vulnerability is not confined to a single vendor. Windows systems were confirmed to be among those impacted, but researchers suggest other operating systems and network devices may share similar weaknesses. The attack does not require local network access—malicious actors could potentially exploit it remotely if they can send packets that trigger the NAT state manipulation.
Why it matters
NatJack demonstrates that even foundational network components like NAT are not immune to deep-seated vulnerabilities. For organizations, this means existing security controls that rely on NAT for isolation or port mapping may no longer be sufficient. The ability to hijack sessions and spoof DNS at this level could undermine trust in core networking protocols and force a rethink of how connection state is managed in modern infrastructures.
Source: The Hacker News. AI-assisted editorial synthesis — TechnoExpress.