Windows NAT CVE-2026-56181

Exploitation requires the Windows NAT feature to be active on the target (e.g., Hyper-V virtual switch/default switch, Internet Connection Sharing, Windows container NAT networking, or WSL2 NAT mode) on Windows 11 24H2/25H2/26H1 or Windows Server 2025, and the attacker must be on an adjacent network (AV:A) - the same L2 segment/broadcast domain or a directly linked network, not the routed internet. No authentication and no user interaction are needed (PR:N/UI:N), but the high attack complexity (AC:H) means success depends on winning a timing/state race or meeting specific network conditions the attacker cannot fully control, and hosts without the NAT service enabled are not exploitable - these factors meaningfully limit realistic exploitation despite the unauthenticated, network-facing nature of the flaw.

The CVSS 3.1 vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H yields 8.3 (High): no privileges or user interaction are required and a scope change (S:C) reflects that compromising the NAT boundary can affect systems beyond the vulnerable component, which drives the score up. Two factors materially reduce real-world urgency: AV:A restricts the attacker to an adjacent network (same subnet/broadcast domain or logically adjacent link, not the open internet), and AC:H indicates the attacker must win a race, predict state, or meet timing/network conditions that are not trivially controllable. There is no EPSS score, KEV listing, or POC in the provided data - no public exploit identified at time of analysis and no evidence of active exploitation - so despite the high CVSS this is best treated as a patch-in-normal-cycle item for most environments, prioritized higher where untrusted hosts share a segment with NAT-enabled Windows (virtualization hosts, container hosts, ICS gateways). Note a mild tension worth verifying: Microsoft rates C:H/I:H/A:H, but an origin-validation/spoofing weakness most directly implies an integrity impact - the full confidentiality and availability impact should be confirmed against Microsoft's advisory.

An attacker who has gained a foothold on a device within the same adjacent network as a Windows Server 2025 virtualization host running Windows NAT crafts spoofed packets that impersonate a trusted internal or external endpoint. By repeatedly timing the injection to win the required race condition (AC:H), the attacker defeats the NAT origin check and gets malicious traffic mapped as if it came from a legitimate host, enabling session hijacking or interposition across the NAT boundary. No public proof-of-concept is identified at this time, and the adjacent-network requirement means the attacker must already be on the local link.