NatJack exploits put NAT security assumptions to the test at Black Hat

Key Points:

• NatJack is a newly disclosed attack class that exploits vulnerabilities in Network Address Translation (NAT) to hijack connections, poison DNS responses, and cause denial of service without requiring victim interaction.
• All tested NAT implementations across various platforms (Windows, Linux, macOS) were found vulnerable, indicating a fundamental flaw in NAT design rather than isolated bugs.
• Recommended actions include monitoring NAT tables for anomalies, enabling source IP protection, segmenting untrusted traffic, disabling loose connection modes, and isolating cloud workloads.

Technical Details: NatJack techniques include TCP connection hijacking via RFC 1337 exploitation, DNS response poisoning through UDP interception, and denial of service by exhausting the NAT table. Relevant CVEs include CVE-2026-63913 and CVE-2026-56181.

MITRE ATT&CK Techniques:

• None mentioned

IOCs Mentioned:

• None mentioned