CVE-2026-56179 Overview
CVE-2026-56179 is an origin validation error [CWE-346] in the Windows Network Address Translation (NAT) component. An unauthenticated attacker positioned on an adjacent network can perform spoofing attacks against affected Windows systems. The flaw impacts current Windows 11 releases and Windows Server 2025. Successful exploitation results in a scope change, meaning impact extends beyond the vulnerable component to other resources. Confidentiality, integrity, and availability are all affected at a high level. Microsoft published the advisory on August 11, 2026.
Critical Impact
An adjacent-network attacker can spoof traffic through the Windows NAT service, compromising confidentiality, integrity, and availability of resources beyond the NAT component itself.
Affected Products
- Microsoft Windows 11 24H2 (x64, ARM64)
- Microsoft Windows 11 25H2 (x64, ARM64)
- Microsoft Windows 11 26H1 (x64, ARM64)
- Microsoft Windows Server 2025 (x64)
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-56179 published to NVD
- 2026-08-11 - Microsoft releases security advisory
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-56179
Vulnerability Analysis
The vulnerability resides in the Windows Network Address Translation (NAT) implementation used by Windows 11 and Windows Server 2025. Windows NAT translates addresses between internal and external networks and is commonly deployed with Internet Connection Sharing, Hyper-V networking, and container networking. The service fails to properly validate the origin of network packets it processes. An attacker on the same broadcast domain or logically adjacent network can craft packets that the NAT engine accepts as legitimate traffic from a trusted source.
The attack results in a scope change. This means the spoofed traffic can influence systems and resources beyond the vulnerable NAT component, including guest virtual machines, containers, or hosts reachable through the translated network path.
Root Cause
The root cause is an origin validation error tracked as [CWE-346]. The NAT component does not sufficiently verify that inbound packets originated from the network segment or source they claim to represent. Because trust decisions rely on unverified packet attributes, an adversary can inject frames that bypass the intended source-based filtering and translation logic.
Attack Vector
Exploitation requires adjacent network access, such as the same Layer 2 segment, VLAN, or Wi-Fi network as the target. Authentication is not required and no user interaction is needed. Attack complexity is rated high, which indicates the attacker must meet specific network positioning or timing conditions to successfully spoof traffic. Verified proof-of-concept code is not publicly available at the time of writing.
See the Microsoft Security Update CVE-2026-56179 advisory for vendor-specific technical details.
Detection Methods for CVE-2026-56179
Indicators of Compromise
- Unexpected ARP or neighbor discovery entries mapping trusted IP addresses to unknown MAC addresses on segments where Windows NAT is enabled.
- Anomalous traffic patterns on Hyper-V virtual switches, Windows Internet Connection Sharing interfaces, or Windows container networks.
- NAT translation table entries referencing source addresses that should not appear on the internal segment.
Detection Strategies
- Monitor Windows event logs and Windows Filtering Platform (WFP) telemetry for anomalies in NAT session establishment on affected hosts.
- Deploy network sensors on adjacent segments to identify duplicate MAC or IP pairings and spoofed frames targeting Windows NAT gateways.
- Correlate host-based process telemetry with network flow data to identify lateral movement attempts that follow spoofed NAT traffic.
Monitoring Recommendations
- Enable verbose logging on Hyper-V virtual switches and container network drivers, and forward records to a centralized SIEM for correlation.
- Track patch state of Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 hosts to prioritize hosts still exposed to CVE-2026-56179.
- Alert on new or unexpected NAT rules and Internet Connection Sharing activations on servers and workstations.
How to Mitigate CVE-2026-56179
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-56179 to all affected Windows 11 and Windows Server 2025 systems.
- Inventory systems running Windows NAT, Internet Connection Sharing, Hyper-V virtual switches, or Windows container networking and prioritize them for patching.
- Restrict physical and logical access to network segments hosting Windows NAT services until patches are deployed.
Patch Information
Microsoft has released a security update addressing CVE-2026-56179 through the Microsoft Update Guide. Refer to the Microsoft Security Update CVE-2026-56179 entry for KB numbers and update packages that apply to each affected Windows 11 release and Windows Server 2025.
Workarounds
- Disable the Windows NAT service or Internet Connection Sharing on hosts that do not require it, using Get-NetNat and Remove-NetNat PowerShell cmdlets.
- Segment Hyper-V and container networks onto dedicated VLANs to reduce the population of devices that qualify as adjacent attackers.
- Enforce Layer 2 protections such as DHCP snooping, dynamic ARP inspection, and port security on switches serving affected hosts.
# Enumerate and remove unused Windows NAT configurations (PowerShell)
Get-NetNat
Remove-NetNat -Name "<NatName>" -Confirm:$false
# Disable Internet Connection Sharing where not required
Get-Service SharedAccess | Stop-Service
Set-Service SharedAccess -StartupType Disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
