For decades, network design rested on a comfortable assumption: once traffic was inside the perimeter, it was broadly safe. A new attack class called NatJack, disclosed at Black Hat USA 2026 and reported by The Hacker News, takes that assumption apart. It shows that an attacker sitting behind the same network address translation layer as a victim can hijack live TCP sessions, spoof DNS responses and exhaust connection tables, all without ever touching the outside world.
What NatJack actually does — Researched independently by Malcolm Stagg, NatJack manipulates the connection-tracking state that NAT devices rely on to route traffic. The core weakness is an old assumption that hosts sharing a NAT will not tamper with one another's connection state. A privileged attacker on the same NAT can rewrite another system's mappings and redirect an active TCP connection, interfere with a DNS request so the real response reaches the attacker, reveal externally mapped ports, or flood the NAT table until legitimate clients can no longer connect.
The behaviour was found across independently developed implementations on both Windows and Linux, with two high-severity CVEs assigned: one in Windows NAT used by Hyper-V and one in Linux Netfilter connection tracking. It also builds on earlier work that found most tested routers susceptible to NAT-based TCP hijacking, so this is a pattern rather than a one-off. [thehackernews.com]
Why there is no single patch — Vendors have shipped fixes for the specific code flaws, and those updates should be applied without delay. But the researcher is candid that the kernel change only raises the cost of the broader spoofing technique rather than closing it entirely. NatJack is not a single bug to be patched away; it is a consequence of trusting devices simply because they share the same internal network. [thehackernews.com]
The Zero Trust lesson — The official mitigations read like a Zero Trust checklist: separate untrusted workloads from trusted systems, encrypt traffic even inside the internal network, and enforce controls such as IP Source Guard where available. Each assumes a neighbour on the same segment might be hostile. This is precisely the mindset behind Zero Trust and the shift away from perimeter-based security, where trust is never granted by location and every connection is verified on its own merits. [thehackernews.com]
What defenders should do now — Apply the available Windows and Linux updates. Segment untrusted and multi-tenant workloads away from sensitive systems that share NAT infrastructure. Encrypt internal traffic so a hijacked session yields little of value. And treat DNS integrity as a first-class concern. [thehackernews.com]
The bottom line — NatJack will probably not be the last attack to weaponise trust between hosts that share a network. Its real message is strategic: the safe internal network was always a convenient fiction, and it is now an expensive one. Organisations that segment aggressively, encrypt internally and verify every connection will absorb this class of attack with little drama.
