A newly disclosed class of attacks, called NatJack, has exposed deep-seated flaws in the architectural design of network address translation (NAT) systems. Demonstrated at Black Hat USA 2026, the research reveals that the vulnerability allows adversaries to hijack active TCP sessions and spoof DNS traffic by manipulating standard NAT connection tracking. The flaw affects independently developed implementations across major platforms, including Microsoft Windows and Linux—tracked under two distinct CVEs—indicating a systemic issue rather than isolated software bugs.
Security researcher Malcolm Stagg detailed how NatJack exploits predictable behaviors in NAT port mapping and insufficient state validation. By forcing a NAT device to associate malicious packets with an established connection, attackers can intercept, redirect, or inject traffic. The attack class enables multiple malicious outcomes: full TCP session takeover, DNS response spoofing, exposure of internal mapped ports, and denial-of-service via connection table exhaustion.
For years, NAT has been a cornerstone of network architecture, frequently misperceived as a security feature that shields internal networks through address obscurity. The NatJack findings fundamentally challenge this notion, proving that diverse NAT implementations share common design weaknesses. Because the flaw resides in the core logic of connection tracking and port allocation, patching any single device or software will not fully mitigate the threat. This realization forces a critical reassessment of perimeter defense strategies that rely heavily on NAT.
Addressing NatJack demands a two-tiered response. In the short term, organizations must prioritize applying vendor patches that implement randomized port mappings and stricter TCP sequence number validation. Administrators should also conduct immediate audits to identify and disable unnecessary port forwarding rules. Long-term resilience will require strengthening defense-in-depth by adding application-layer inspection to verify traffic legitimacy. The open-source community, including projects like pf, nftables, and pfSense, will need to proactively audit their NAT implementations, as they cannot depend solely on upstream fixes.
As vendors develop and distribute mitigations, the NatJack research underscores a critical reminder: foundational networking mechanisms demand continuous scrutiny, and effective security must be built on layered verification, not obscured routing. The disclosure serves as a catalyst for organizations worldwide to re-examine network segmentation and ensure that reliance on NAT alone does not create a false sense of security.
一種新披露的攻擊手法，名為NatJack，揭露了網絡地址轉換（NAT）系統架構設計中深層的缺陷。這項研究在Black Hat USA 2026上演示，顯示該漏洞允許攻擊者透過操控標準NAT連線追蹤機制，劫持活躍的TCP連線並偽造DNS流量。此缺陷影響跨多個主要平台獨立開發的實現方案，包括Microsoft Windows和Linux——由兩個不同的CVE跟蹤——這表明是系統性問題而非孤立的軟件錯誤。
安全研究員Malcolm Stagg詳細闡述了NatJack如何利用NAT端口映射中的可預測行為及不充分的狀態驗證。透過強制NAT裝置將惡意封包與已建立的連線關聯，攻擊者可攔截、重定向或注入流量。此類攻擊可導致多種惡意後果：完全接管TCP連線、偽造DNS回應、暴露內部映射端口，以及透過耗盡連線表達成拒絕服務。
多年來，NAT一直是網絡架構的基石，常被誤認為透過地址隱蔽來保護內部網絡的安全功能。NatJack的發現根本性地挑戰了這觀念，證明不同的NAT實現方案共享共同的設計弱點。由於缺陷存在於連線追蹤和端口分配的核心邏輯中，僅修補單一裝置或軟件並不能完全緩解威脅。這認知迫使必須重新評估嚴重依賴NAT的邊界防禦策略。
應對NatJack需要雙管齊下的回應。短期內，機構必須優先應用供應商補丁，實施隨機化端口映射及更嚴格的TCP序列號驗證。管理員亦應立即進行審計，識別並停用不必要的端口轉發規則。長期韌性則需透過加強縱深防禦，加入應用層檢查以驗證流量合法性。開源社群（包括pf、nftables及pfSense等項目）將需主動審計其實現的NAT方案，因他們不能僅依賴上游修補。
隨著供應商開發和分發緩解措施，NatJack研究強調了關鍵提醒：基礎網絡機制需要持續審查，而有效安全必須建立於分層驗證之上，而非僅依賴模糊的路由機制。此披露為全球機構提供了催化劑，以重新檢視網絡分段並確保僅依賴NAT不會造成虛假的安全感。