Which versions of NetKids iMark are affected by CVE-2026-66839?

NetKids iMark (all versions through 5.2.5.0) contains a privilege escalation flaw allowing authenticated local attackers to achieve SYSTEM-level access through an unquoted service executable path.

How to fix or mitigate CVE-2026-66839?

Within 24 hours, inventory all NetKids iMark installations and confirm versions in use. Within 7 days, implement vendor-published remediation guidance by adding quotation marks to the service executable path in Windows service configuration, and reconfigure the NetKids iMark service account to run with minimal required privileges. Within 30 days, assess availability of versions beyond 5.2.5.0 and plan upgrade or migration strategy; deploy behavioral monitoring across affected systems to detect privilege escalation attempts.

NetKids iMark CVE-2026-66839

Q: What is the CVSS score of CVE-2026-66839?

CVE-2026-66839 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-53044 HIGH

Unquoted Search Path or Element (CWE-428)

2026-08-05 jpcert

GHSA-gwvf-28g3-g437

RCE Netkids Imark

8.4

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.4 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Local vector with high privilege required to write to the service path; privilege escalation to SYSTEM justifies S:C with full C/I/A impact on the host.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 06:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 06:22 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 06:22 NVD

MEDIUM HIGH

CVSS changed

Aug 05, 2026 - 06:22 NVD

6.7 (MEDIUM) 8.4 (HIGH)

Analysis Generated

Aug 05, 2026 - 05:58 vuln.today

DescriptionCVE.org

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.

AnalysisAI

Privilege escalation to SYSTEM in NetKids iMark (all versions through V5.2.5.0) is achievable by authenticated local attackers exploiting an unquoted Windows service executable path. Because the service path contains spaces but lacks surrounding quotation marks, Windows' path resolution logic will execute an attacker-placed binary at an intermediate path before reaching the legitimate service binary. JPCERT/CC has issued an advisory (JVN#28045338) and the vendor has published remediation PDF guidance; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-428 (Unquoted Search Path or Element) is a Windows-specific vulnerability class affecting services whose ImagePath registry value contains spaces but no enclosing quotation marks. When the Windows Service Control Manager launches such a service, it parses the path sequentially at each space boundary - for example, a path of C:\Program Files\NetKids iMark\service.exe causes Windows to first attempt C:\Program.exe, then C:\Program Files\NetKids.exe, before reaching the intended binary. An attacker with write access to any of these intermediate directories can plant a malicious executable there; on the next service start or system reboot it is executed as SYSTEM. The CPE identifier cpe:2.3:a:integrated_systems_technologies,_inc.:netkids_imark:*:*:*:*:*:*:*:* confirms all iMark releases up to V5.2.5.0 are within scope, as corroborated by the EUVD entry EUVD-2026-53044 and the JPCERT/CC advisory.

RemediationAI

Administrators should consult the vendor's official remediation PDFs - addressing both DLL loading and unquoted service path issues - linked from the JVN advisory at https://jvn.jp/en/jp/JVN28045338/ and the Integrated Systems Technologies support portal, then apply the latest available release. The exact patched version number is not independently confirmed in the available data and must be obtained directly from the vendor advisories before updating. As a compensating control pending a patch, administrators can manually enclose the NetKids iMark service ImagePath value in double quotation marks via the Windows registry (HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>\ImagePath); note that this change must be re-verified after any software update, as an installer may overwrite the registry entry. Additionally, restricting write permissions on all directories in the service's installation path to administrators only will eliminate the attacker's ability to plant an intermediate executable without affecting normal application functionality.