Windows NAT CVE-2026-56179

Exploitation requires the attacker to be physically or logically adjacent to the target - i.e., on the same LAN, VLAN, Wi-Fi segment, or directly connected network where the vulnerable Windows host is reachable at Layer 2 or Layer 3 with no intervening routing hop. The Windows NAT feature must be active on the target host; this is not enabled by default on all installations and is specifically relevant in Hyper-V NAT switch configurations or Internet Connection Sharing (ICS) deployments. CVSS PR:N confirms no credentials are required - an unauthenticated adjacent attacker suffices. AC:H limits exploitation: crafting packets that reliably trigger the origin validation flaw likely requires knowledge of active NAT flow state and precise packet timing, which limits opportunistic exploitation. Exploitation is further constrained to modern Windows versions (Server 2025, Windows 11 24H2 and later); older Windows releases are not listed as affected.

The NVD CVSS score of 8.3 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) accurately characterizes a high-severity vulnerability with meaningful architectural constraints. AV:A limits exposure to attackers with physical or logical adjacency to the target network (same LAN segment, VLAN, or wireless network), significantly reducing the real-world attack surface compared to internet-facing vulnerabilities. AC:H signals that reliably crafting a packet that exploits the origin validation flaw requires specific knowledge of NAT state tables and timing, making opportunistic mass exploitation unlikely. The S:C (scope changed) metric elevates the score by acknowledging that victims of a successful attack are not just the NAT host but the systems whose traffic is translated - a realistic MitM consequence. No EPSS data was provided in the input; without that signal, exploitation probability must be inferred from structural factors alone. There is no KEV listing and no confirmed POC. The tag 'Authentication Bypass' aligns with PR:N and suggests exploitation does not require credentials. Overall: this is a real priority for environments where Windows NAT (Hyper-V NAT or ICS) is actively deployed, but the adjacent-network constraint and high complexity substantially reduce risk compared to a network-accessible vulnerability of equivalent CVSS score.

An attacker with access to the same network segment as a Windows host running the NAT service (for example, a rogue VM on a Hyper-V host, or a device on the same LAN as a Windows ICS gateway) crafts packets with spoofed origin addresses that exploit the NAT implementation's failure to validate packet provenance. By injecting these packets at the right moment in connection state, the attacker could hijack or intercept translated flows belonging to other hosts behind the NAT boundary. No public proof-of-concept exploit has been identified at time of analysis, and AC:H suggests reliable exploitation requires knowledge of the NAT connection table state.