Windows Network Address Translation (NAT) Spoofing Vulnerability
Impact
Windows Network Address Translation (NAT) has an origin validation error, allowing an unauthorized attacker to perform spoofing over an adjacent network, affecting Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2025. The attacker needs access to an adjacent network. The weakness is an origin validation error.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · microsoft
Windows 11 Version 24H2
1 range
Microsoft · microsoft
Windows 11 Version 24H2
Compare with this publisher’s ranges. This does not inspect your installation.
affected
10.0.26100.0 → before 10.0.26100.9168
custom versions
Other versions: unknown
Microsoft · microsoft
Windows 11 Version 25H2
1 range
Microsoft · microsoft
Windows 11 Version 25H2
Compare with this publisher’s ranges. This does not inspect your installation.
affected
10.0.26200.0 → before 10.0.26200.9168
custom versions
Other versions: unknown
Microsoft · microsoft
Windows 11 version 26H1
1 range
Microsoft · microsoft
Windows 11 version 26H1
Compare with this publisher’s ranges. This does not inspect your installation.
affected
10.0.28000.0 → before 10.0.28000.2704
custom versions
Other versions: unknown
Microsoft · microsoft
Windows Server 2025
1 range
Microsoft · microsoft
Windows Server 2025
Compare with this publisher’s ranges. This does not inspect your installation.
affected
10.0.26100.0 → before 10.0.26100.33296
custom versions
Other versions: unknown
Microsoft · microsoft
Windows Server 2025 (Server Core installation)
1 range
Microsoft · microsoft
Windows Server 2025 (Server Core installation)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
10.0.26100.0 → before 10.0.26100.33296
custom versions
Other versions: unknown
Original source description
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-56179View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
microsoft · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*From (inclusive): 10.0.26100.0
Before: 10.0.26100.33296
Vulnerable product
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*From (inclusive): 10.0.26200.0
Before: 10.0.26200.9168
Vulnerable product
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*From (inclusive): 10.0.26100.0
Before: 10.0.26100.9168
Vulnerable product
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*From (inclusive): 10.0.26100.0
Before: 10.0.26100.33296
Vulnerable product
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*From (inclusive): 10.0.28000.0
Before: 10.0.28000.2704
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.26100.0",
"versionEndExcluding": "10.0.26100.33296"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*",
"versionStartIncluding": "10.0.26200.0",
"versionEndExcluding": "10.0.26200.9168"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*",
"versionStartIncluding": "10.0.26100.0",
"versionEndExcluding": "10.0.26100.9168"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.26100.0",
"versionEndExcluding": "10.0.26100.33296"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*",
"versionStartIncluding": "10.0.28000.0",
"versionEndExcluding": "10.0.28000.2704"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.