Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-15 | 1 | Patch1 |
| 2026-07-16 | 1 | Patch1 |
| 2026-08-07 | 3 | Active Exploitation1Disclosure2 |
| 2026-08-08 | 1 | Patch1 |
| 2026-08-09 | 1 | Patch1 |
| 2026-08-10 | 2 | Disclosure1False Positive1 |
| 2026-08-11 | 1 | Active Exploitation1 |
| 2026-09-04 | 1 | Disclosure1 |
| 2026-09-27 | 1 | Disclosure1 |
Although I don’t fully agree with implied attack preconditions and severity, I appreciate @msftsecresponse work to patch and publish CVE-2026-56181 yesterday! https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56181
Post summary
The user acknowledges the release of a patch for CVE‑2026‑56181 but provides no additional technical or exploit details.
تعليق مزودين الخدمات والشركات كانت متباينه 😆 🔹فريق Linux Kernel رفض التقرير أول مرة ووصفه بأنه "bogus". 🔹 Microsoft طلبت إصلاح المشكلة لحماية Azure Kubernetes، ونزل التصحيح تحت: CVE-2026-63913 — 8.2 🔹وفي Windows، نفس الفكرة وصلت إلى Hyper-V NAT لذلك تم الترقيع: CVE-2026-56181 — 8.3 🔹لكن Cisco وApple كان موقفهم مختلف: المشكلة سلوك تصميمي وليست ثغرة، والحل عندهم استخدام TLS.
Post summary
Microsoft issued patches for CVE‑2026‑63913 and CVE‑2026‑56181, while Linux Kernel and Apple dismiss the reports as non‑vulnerabilities; Cisco opts to mitigate with TLS.
Security researcher Malcolm Stagg disclosed NatJack, an attack class that manipulates NAT state to hijack TCP sessions and spoof DNS responses. Windows NAT/Hyper-V (CVE-2026-56181, CVSS 8.3) and Linux Netfilter conntrack (CVE-2026-63913, CVSS 8.2) are both affected. Attackers need a foothold on the same NAT as the victim; no single patch fixes it, so segment untrusted workloads and encrypt internal traffic.
Post summary
Malcolm Stagg discloses NatJack, a NAT‑based attack class affecting Windows and Linux (CVE‑2026‑56181, CVE‑2026‑63913) with no active exploitation or PoC reported, and recommends mitigating via workload segmentation and traffic encryption.
Vulnerabilidades destacadas del mes: entre las miles de CVEs publicadas durante agosto, destacamos dos por su impacto en organizaciones de la región: - CVE-2026-68820 Windows AFD.sys (WinSock) — elevación de privilegios zero-day (con vínculos con APT Lazarus-NC) - CVE-2026-56181 NatJack — nueva clase de ataque contra NAT en Windows Hyper-V y otras plataformas ( Clasificada con una puntuación CVSS de 8.3, no es un error de codigo, es una falla de diseño estructural)
Post summary
El texto destaca dos CVEs de alto impacto: CVE-2026-68820, que es una elevación de privilegios en WinSock, y CVE-2026-56181, una nueva clase de ataque NAT en Windows Hyper‑V, sin mencionar PoC, exploits activos o parches disponibles.
One flaw, three verdicts. Microsoft patched NatJack and assigned CVE-2026-56181 (CVSS 8.3). Linux's own security team called the report "totally bogus," then fixed it anyway, at Microsoft's request, to protect Azure Kubernetes Service. Cisco and Apple say the same underlying weakness isn't a vulnerability at all. It's a 1990s NAT trust assumption, still live in every shared Kubernetes cluster today. Your CVE feed can't tell you if you're exposed, your architecture has to. Know which workloads share a NAT boundary with something you don't trust? https://www.networkworld.com/article/4206287/natjack-exploits-put-nat-security-assumptions-to-the-test-at-black-hat.html
Post summary
The post debunks the reported NatJack flaw as a false positive, notes that Microsoft patched it, and highlights that major vendors see the weakness as non‑vulnerable.
🛡️ NatJack isn’t a “every home router is doomed” moment—it's a Hyper-V shared-NAT flaw. Patch Windows and Linux conntrack before your lab becomes an attacker’s networking playground. https://windowsforum.com/windows-news.4/cve-2026-56181-patch-hyper-v-nat-against-natjack-spoofing.442039/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #Natjack #WindowsHyperV #LinuxConntrack #NatSecurity https://t.co/tJRsQEzw39
Post summary
The tweet highlights CVE‑2026‑56181 as a Hyper‑V shared‑NAT flaw and urges patching of Windows and Linux conntrack to prevent potential exploitation.
CVE-2026-56181: Windows Network Address Translation Spoofing Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04ynQRg0
Post summary
The text announces CVE-2026-56181, a Windows NAT Spoofing vulnerability, and references an external article discussing business impact and response guidance, functioning primarily as a vulnerability disclosure notice.
Recent NatJack attacks exploit NAT for TCP hijack & DNS spoofing (CVE-2026-56181, CVE-2026-63913), compromising data privacy/integrity in transit. New Spacebar Server CVE allows cross-channel message deletion. #Cybersecurity #Geopolitics #News
Post summary
The tweet reports that recent NatJack attacks use CVE-2026-56181 and CVE-2026-63913 to hijack TCP and spoof DNS, demonstrating active exploitation, and also notes a Spacebar Server CVE that deletes cross‑channel messages.
🎯 NatJack — new NAT manipulation attack hijacks TCP sessions & spoofs DNS Researcher Malcolm Stagg unveiled NatJack at Black Hat USA 2026. Affects Windows (CVE-2026-56181, CVSS 8.3) and Linux Netfilter (CVE-2026-63913, CVSS 8.2). Enables TCP hijacking, DNS spoofing, and NAT table exhaustion. Attacker needs same-NAT access. 🔗 Source: The Hacker News / Black Hat 2026 #NAT #NetworkSecurity #BlackHat2026 #TCPHijack
Post summary
The post reveals the discovery and technical details of the NatJack vulnerability, but does not provide exploitation evidence, patches, or evidence of active attacks.
TRC analysis shows NatJack attacks exploit NAT vulnerabilities (CVE-2026-56181, CVE-2026-63913) to hijack active TCP sessions and spoof DNS responses. Attackers manipulate connection states to move laterally within networks behind the same NAT. Runtime segmentation helps limit blast radius when internal pivoting occurs. #ZeroTrust #ThreatIntel 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/new-natjack-attacks-hijack-tcp-sessions-and-spoof-dns-by-manipulating-nat-tables
Post summary
NatJack attacks exploit CVE‑2026‑56181 and CVE‑2026‑63913 to hijack TCP sessions and spoof DNS replies, showcasing active exploitation within networks sharing the same NAT device.
Security research exposes NatJack attacks that hijack TCP sessions through NAT table manipulation. The flaws hit Windows NAT under CVE-2026-56181 and Linux Netfilter conntrack under CVE-2026-63913. An attacker behind the same NAT can hijack TCP sessions that legitimate users rely on. The technique allows attackers to spoof DNS responses, expose mapped ports, and exhaust connection tables. Linux kernel maintainers patched stable releases including 5.10.259, 6.1.176, 6.6.143, and 7.1. Microsoft released security updates for affected Windows 11 and Windows Server 2025 builds. Assuming adjacent devices on shared networks wouldn't tamper with connection states was a massive design blindspot.
Post summary
Security research reveals NatJack attacks enabling TCP session hijacking via NAT table manipulation, affecting Windows NAT (CVE-2026-56181) and Linux Netfilter conntrack (CVE-2026-63913), with vendor patches already released.
🪟 Windows NAT spoofing means nearby attackers could impersonate traffic without logging in. Install KB5101650—because “trust your network” is adorable until the network lies. https://windowsforum.com/threads/cve-2026-56181-install-kb5101650-to-fix-windows-nat-spoofing.438874/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PatchManagement #NatVulnerability #Cve202656181 https://t.co/Uq7tNTaISy
Post summary
The tweet warns about CVE-2026-56181, a Windows NAT spoofing flaw that lets nearby attackers impersonate traffic, and urges users to install the KB5101650 patch to mitigate the risk.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_11_24h2 | - | - | - |
| OS | microsoft | windows_11_25h2 | - | - | - |
| OS | microsoft | windows_11_26h1 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | - |