Affected Systems

Windows NAT (Hyper-V): Windows 11 24H2 <26100.8875, 25H2 <26200.8875, 26H1 <28000.2525, Server 2025 <26100.33158 (CVE-2026-56181, CVSS 8.3). Linux Netfilter conntrack: kernel <5.10.259, <5.15.210, <6.1.176, <6.6.143, <6.12.93, <6.18.35, <7.0.12, <7.1 (CVE-2026-63913, CVSS 8.2). Broader attack class affects multiple NAT implementations across vendors; no comprehensive product list published.

Exploitation Status

No public evidence of in-the-wild exploitation as of August 7, 2026. Proof-of-concept demonstrated in controlled environment against dozens of real-world network infrastructure products. Requires attacker to have privileged access to a system behind the same NAT as victim.

Business Impact

Attackers with privileged access behind shared NAT infrastructure can hijack active TCP sessions, spoof DNS responses to redirect traffic, enumerate externally mapped ports, or exhaust NAT tables to deny service. Primary risk to environments where untrusted workloads (e.g., multi-tenant virtualization, shared hosting) share NAT with trusted systems. Windows Hyper-V and Linux Netfilter conntrack have specific CVEs; broader attack class has no single patch. Kernel fixes mitigate but do not fully eliminate downstream-spoofing techniques.

Urgency

🟡 Within a week

Recommended Actions

  • ["Apply Windows updates for CVE-2026-56181: Windows 11 24H2 to 26100.8875+, 25H2 to 26200.8875+, 26H1 to 28000.2525+, Server 2025 to 26100.33158+."]
  • ["Update Linux kernel for CVE-2026-63913 to fixed stable releases: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1+."]
  • ["Segregate untrusted workloads (multi-tenant VMs, containers, guest systems) from trusted systems sharing NAT infrastructure; use separate NAT instances or VLANs where possible."]
  • ["Enforce encryption (TLS/IPsec) for internal traffic, especially DNS and management protocols, to limit impact of session hijacking and spoofing."]
  • ["Deploy IP Source Guard on switches supporting the feature to validate source IP/MAC bindings and reduce spoofing risk within the same broadcast domain."]