CVE-2026-56179: Windows Network Address Translation (NAT) Spoofing Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · October 28, 2026 NatJack: NAT Table Attacks Explained, Who Is Affected, and What Measures Are Needed NatJack is a new class of attacks against NAT devices: An attacker behind the same router, firewall, or Docker bridge can hijack other TCP connections, intercept DNS responses, or disable NAT. How the attack works, which products are affected, when action is needed, and which measures are effective.

Vendor description

Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.

Reference data

Vendor

Microsoft

Affected products

Windows 11 Version 24H2
Windows 11 Version 25H2
Windows 11 version 26H1
Windows Server 2025
Windows Server 2025 (Server Core installation)

CVSS 3.1

8.3 (HIGH)

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

Weakness type

CWE-346: Origin Validation Error

Published

August 11, 2026

Official sources

← All vulnerabilities