Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack. One can redirect traffic from an active TCP connection by replacing its NAT mapping. Other techniques disclose externally mapped ports or fill the NAT connection table with spoofed flows until legitimate clients cannot create new connections. The Hacker News found no public evidence that NatJack techniques have been exploited in the wild as of August 7, 2026.