CVE-2026-63913Disclosure

MEDIUMCVSS 8.2 · HIGH

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
6 mentions across 4 observed days

What's happening

Active exploitation reported across 2 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 3 classified signals
Peaked 3d ago at 3 mentions (2026-08-07); latest day: 1
6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

350.0%

Active Exploitation

233.3%

Patch

116.7%

Referenced assets1 URL

By indicator

https://aviatrix.ai/threat-research-center/new-natjack-attacks-hijack-tcp-sessions-and-spoof-dns-by-manipulating-nat-tables

Classification over time

Date	Total	Labels

2026-08-07	3	Active Exploitation1Disclosure2
2026-08-09	1	Patch1
2026-08-10	1	Disclosure1
2026-08-11	1	Active Exploitation1

Full discourse6 posts

إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi44d
Patch
تعليق مزودين الخدمات والشركات كانت متباينه 😆 🔹فريق Linux Kernel رفض التقرير أول مرة ووصفه بأنه "bogus". 🔹 Microsoft طلبت إصلاح المشكلة لحماية Azure Kubernetes، ونزل التصحيح تحت: CVE-2026-63913 — 8.2 🔹وفي Windows، نفس الفكرة وصلت إلى Hyper-V NAT لذلك تم الترقيع: CVE-2026-56181 — 8.3 🔹لكن Cisco وApple كان موقفهم مختلف: المشكلة سلوك تصميمي وليست ثغرة، والحل عندهم استخدام TLS.
Post summary
The post announces Microsoft and Windows patches for CVE-2026‑63913 and CVE-2026‑56181 while noting that Linux Kernel dismisses the report as bogus; Cisco and Apple consider it a design behavior rather than a vulnerability.
10010325
50.0K followersView on X
Xavier Rivera@XavierRiveraX45d
Disclosure
Security researcher Malcolm Stagg disclosed NatJack, an attack class that manipulates NAT state to hijack TCP sessions and spoof DNS responses. Windows NAT/Hyper-V (CVE-2026-56181, CVSS 8.3) and Linux Netfilter conntrack (CVE-2026-63913, CVSS 8.2) are both affected. Attackers need a foothold on the same NAT as the victim; no single patch fixes it, so segment untrusted workloads and encrypt internal traffic.
Post summary
Malcolm Stagg discloses the NatJack attack class affecting Windows NAT/Hyper‑V (CVE‑2026‑56181) and Linux Netfilter conntrack (CVE‑2026‑63913), describes the threat and offers mitigation via segmentation and encryption.
00020140
605 followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc42d
Active Exploitation
Recent NatJack attacks exploit NAT for TCP hijack & DNS spoofing (CVE-2026-56181, CVE-2026-63913), compromising data privacy/integrity in transit. New Spacebar Server CVE allows cross-channel message deletion. #Cybersecurity #Geopolitics #News
Post summary
The post reports real‑world attacks by NatJack exploiting CVE-2026-56181 and CVE-2026-63913 through TCP hijack and DNS spoofing, but it provides no PoC, patch, or exploit code details.
0000097
17 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX42d
Disclosure
🎯 NatJack — new NAT manipulation attack hijacks TCP sessions & spoofs DNS Researcher Malcolm Stagg unveiled NatJack at Black Hat USA 2026. Affects Windows (CVE-2026-56181, CVSS 8.3) and Linux Netfilter (CVE-2026-63913, CVSS 8.2). Enables TCP hijacking, DNS spoofing, and NAT table exhaustion. Attacker needs same-NAT access. 🔗 Source: The Hacker News / Black Hat 2026 #NAT #NetworkSecurity #BlackHat2026 #TCPHijack
Post summary
The article introduces NatJack, a newly disclosed NAT manipulation vulnerability affecting Windows and Linux, detailing its CVEs, impact, and technical aspects.
0000081
36 followersView on X
Aviatrix Threat Research Center@aviatrixtrc45d
Active Exploitation
TRC analysis shows NatJack attacks exploit NAT vulnerabilities (CVE-2026-56181, CVE-2026-63913) to hijack active TCP sessions and spoof DNS responses. Attackers manipulate connection states to move laterally within networks behind the same NAT. Runtime segmentation helps limit blast radius when internal pivoting occurs. #ZeroTrust #ThreatIntel 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/new-natjack-attacks-hijack-tcp-sessions-and-spoof-dns-by-manipulating-nat-tables
Post summary
The message reports that NatJack attackers are actively exploiting CVE-2026-56181 and CVE-2026-63913 to hijack TCP sessions and spoof DNS responses, indicating live exploitation in the wild.
00000114
1.9K followersView on X
Zubiqo@zubiqo45d
Disclosure
Security research exposes NatJack attacks that hijack TCP sessions through NAT table manipulation. The flaws hit Windows NAT under CVE-2026-56181 and Linux Netfilter conntrack under CVE-2026-63913. An attacker behind the same NAT can hijack TCP sessions that legitimate users rely on. The technique allows attackers to spoof DNS responses, expose mapped ports, and exhaust connection tables. Linux kernel maintainers patched stable releases including 5.10.259, 6.1.176, 6.6.143, and 7.1. Microsoft released security updates for affected Windows 11 and Windows Server 2025 builds. Assuming adjacent devices on shared networks wouldn't tamper with connection states was a massive design blindspot.
Post summary
The post announces new vulnerabilities (CVE‑2026‑56181 and CVE‑2026‑63913) affecting Windows NAT and Linux Netfilter, explains how attackers can hijack TCP sessions via NAT table manipulation, and lists available patches for both Windows and Linux.
00000158
156 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-63913

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediPatch

The post announces Microsoft and Windows patches for CVE-2026‑63913 and CVE-2026‑56181 while noting that Linux Kernel dismisses the report as bogus; Cisco and Apple consider it a design behavior rather than a vulnerability.

Xavier Rivera[verified]@XavierRiveraXDisclosure

Malcolm Stagg discloses the NatJack attack class affecting Windows NAT/Hyper‑V (CVE‑2026‑56181) and Linux Netfilter conntrack (CVE‑2026‑63913), describes the threat and offers mitigation via segmentation and encryption.

CyberSignal | Cybersecurity News[verified]@XQOPTRXDisclosure

The article introduces NatJack, a newly disclosed NAT manipulation vulnerability affecting Windows and Linux, detailing its CVEs, impact, and technical aspects.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The message reports that NatJack attackers are actively exploiting CVE-2026-56181 and CVE-2026-63913 to hijack TCP sessions and spoof DNS responses, indicating live exploitation in the wild.

Zubiqo[verified]@zubiqoDisclosure

The post announces new vulnerabilities (CVE‑2026‑56181 and CVE‑2026‑63913) affecting Windows NAT and Linux Netfilter, explains how attackers can hijack TCP sessions via NAT table manipulation, and lists available patches for both Windows and Linux.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircActive Exploitation

The post reports real‑world attacks by NatJack exploiting CVE-2026-56181 and CVE-2026-63913 through TCP hijack and DNS spoofing, but it provides no PoC, patch, or exploit code details.