NatJack hijacks TCP sessions and spoofs DNS by manipulating NAT tables — Black Hat 2026 exposes a universal design flaw

August 6, 2026. Malcolm Stagg took the Black Hat USA stage and presented an attack class that doesn’t target a specific OS or firmware version — it targets the idea of Network Address Translation itself. The vulnerability is in the RFCs, not the code.

Stagg demonstrated four distinct offensive capabilities, all reproducible against independently developed NAT implementations: the Windows TCP/IP stack, the Linux netfilter framework, and OpenWrt and pfSense consumer router firmware.

How NatJack works

NAT maintains a connection-tracking table — conntrack on Linux, the NAT mapping table on Windows. Each entry maps an internal (source IP, source port, destination IP, destination port) tuple to a mapped external port.

NatJack exploits a fundamental property of these tables: the race between a connection’s closure and its table entry’s reuse. Stagg identified a time window — tens of milliseconds on modern implementations, up to several seconds on consumer routers — during which a NAT entry is marked as eligible for reuse but still sits in memory.

During that window, an attacker who can send packets toward the target can:

1. Inject a packet into an active TCP session by guessing sequence numbers (made predictable because the NAT entry is still warm).
2. Spoof a DNS response by sending a forged reply whose source port matches a still-open NAT entry.
3. Scan internal ports by probing which NAT entries still respond.
4. Exhaust the NAT table by triggering rapid creation and abandonment of thousands of connections, leading to denial of service.

Platform-by-platform impact

Windows. The NAT behavior in the Windows TCP/IP stack — used by Internet Connection Sharing and the Routing and Remote Access role — offers the most predictable reuse window: 30 milliseconds. Enough for a local or low-latency LAN attack. Microsoft classified the issue as Important and plans a fix in the September 2026 Patch Tuesday.

Linux / netfilter. The nf_conntrack module is vulnerable when nf_conntrack_tcp_timeout_time_wait is greater than zero — which it is by default. The window is shorter (8–12 ms), but the attack can be mounted from a co-located virtual machine, dropping effective latency to near zero. Kernel 7.1.6 (and backports 6.18.42, 6.12.101, 6.6.148) includes a fix that eliminates the reuse window for TIME_WAIT connections.

Consumer routers. This is the worst news. OpenWrt and pfSense firmware exhibits reuse windows up to 4 seconds on some hardware models. An attacker on the same Wi-Fi network can run the attack with zero timing constraints. Upgrading to OpenWrt 24.10.1 or pfSense 2.8.0 closes the gap, but real-world data shows fewer than 15% of consumer routers run patched firmware within six months of disclosure.

What to patch — now

The immediate fix depends on where you sit in the network stack:

• Windows fleet admins: Disable Internet Connection Sharing on every endpoint that doesn’t strictly require it. Schedule the September 2026 patch deployment.
• Linux admins: Update to kernel 7.1.6 / 6.18.42 / 6.12.101 / 6.6.148, or apply the workaround:

echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_timeout_time_wait

This removes the vulnerable window immediately, at the cost of slightly less efficient conntrack entry reuse.

• Router users: Apply the firmware update today. If your router is end-of-life and no longer receives updates, replace it or place it behind a firewall that filters spoofed inbound packets.

• ISPs and cloud operators: Audit your CGNAT (Carrier-Grade NAT) infrastructure. Reuse windows tend to be longer on CGNAT equipment because tables are massive and cleanup algorithms are tuned for throughput, not security. A single compromised CGNAT entry can expose hundreds of subscribers.

The elephant in the room: NAT was never security

Stagg closed his presentation with a point the industry has refused to hear for twenty years: NAT was never designed as a security mechanism. It’s a workaround for IPv4 address exhaustion, repurposed by inertia into a pseudo-firewall.

NatJack is the smoking-gun demonstration that this habit is dangerous. A properly configured stateful firewall — iptables with a default DROP policy, Windows Firewall with inbound blocking — is not vulnerable to NatJack, precisely because it doesn’t perform NAT. It’s the NAT itself that creates the attack surface.

Bottom line

If your network uses NAT, you’re vulnerable. The question isn’t whether — it’s how quickly you patch.

For individuals: update your router firmware tonight. A 4-second reuse window on an unpatched router is an open invitation to anyone on the same Wi-Fi — neighbors, guests, or the malware that already infected the network-connected printer.

For businesses: prioritize exposed equipment — office routers, VPN appliances, CGNAT gateways — and apply patches before the end of the week. NatJack is not an academic proof of concept: exploit code has been public since the Black Hat presentation.

Long term: start planning your IPv6 migration. The day you no longer run NAT is the day NatJack has no surface left to attack.

References

• Malcolm Stagg, “NatJack: Hijacking TCP and DNS Through NAT Table Manipulation,” Black Hat USA, August 6, 2026
• The Hacker News, “New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables,” August 7, 2026
• netfilter documentation — nf_conntrack_tcp_timeout_time_wait
• Microsoft Security Response Center, “CVE-2026-XXXXX — Windows NAT Table Reuse Vulnerability,” August 2026