New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

A newly disclosed attack class, called NatJack, manipulates network address translation connection state to hijack active TCP sessions and spoof DNS responses. This attack also exposes mapped ports and exhausts NAT tables. The research, presented at Black Hat USA 2026, was conducted by security researcher Malcolm Stagg. The affected behavior was found in multiple implementations, including Windows. The NatJack attack works by manipulating NAT tables, allowing for various malicious activities. The vulnerability appears to be present in independently developed implementations.