CVE-2026-66344 - Vulnerability Details

- Uncontrolled Search Path Element Allows Authenticated System‑Level Code Execution in NetKids iMark

Description

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.

Published: 2026-08-05

Score: 5.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

NetKids iMark, supplied by Integrated Systems Technologies, Inc., includes an Uncontrolled Search Path Element flaw (CWE‑427). An attacker who can authenticate to the application can leverage this weakness to execute arbitrary code with SYSTEM privileges. The primary impact is the ability to run code with full local system rights, compromising confidentiality, integrity, and availability of the affected host.

Affected Systems

The vulnerability affects Integrated Systems Technologies, Inc. NetKids iMark. No specific removed or fixed product versions are listed in the advisory; therefore all installations of NetKids iMark that have not been updated or patched are susceptible.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate risk profile. EPSS data is not available, so current exploit probability cannot be quantified, and the vulnerability is not registered in CISA KEV. The likely attack vector requires an authenticated session to the application; an attacker would need to obtain valid credentials or take advantage of an existing authenticated user to trigger the path‑tracing behavior that allows code execution.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Integrated Systems Technologies, Inc.

NetKids iMark

unaffected

Version	Status	Constraints
`0`	affected	≤ V5.2.5.0

No data.

Vendor Product Confidence Versions

Integrated Systems Technologies, Inc.

Netkids Imark

100%

Version	Status	Scheme	Platform
`[0,V5.2.5.0]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update NetKids iMark to the latest version provided by Integrated Systems Technologies, Inc. that addresses the Uncontrolled Search Path Element flaw.
Limit authenticated access by enforcing strong, least‑privilege user credentials and monitoring for anomalous login activity.
Reconfigure the system’s PATH environment variable to exclude untrusted directories, ensuring only approved locations are searched during execution.

Generated by OpenCVE AI on August 5, 2026 at 06:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00116.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://jvn.jp/en/jp/JVN28045338/
https://www.istinc.co.jp/dl/jpc/%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9%E3%81%AE%E5%AE%9F%E8%A1%8C%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%83%91%E3%82%B9%E3%81%8C%E5%BC%95%E7%94%A8%E7%AC%A6%E3%81%A7%E5%9B%B2%E3%81%BE%E3%82%8C%E3%81%A6%E3%81%84%E3%81%AA%E3%81%84%E3%81%93%E3%81%A8%E3%81%AB%E3%82%88%E3%82%8B%E6%A8%A9%E9%99%90%E6%98%87%E6%A0%BC%E3%81%AE%E5%95%8F%E9%A1%8C%E3%81%A8%E5%AF%BE%E5%BF%9C.pdf
https://www.istinc.co.jp/dl/jpc/DLL%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E8%AA%AD%E3%81%BF%E8%BE%BC%E3%81%BF%E3%81%8A%E3%82%88%E3%81%B3%E3%82%A4%E3%83%B3%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AB%E3%83%95%E3%82%A9%E3%83%AB%E3%83%80%E3%81%AE%E3%82%A2%E3%82%AF%E3%82%BB%E3%82%B9%E6%A8%A9%E9%99%90%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E5%95%8F%E9%A1%8C%E3%81%A8%E5%AF%BE%E5%BF%9C.pdf

History

Wed, 05 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 05 Aug 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Integrated Systems Technologies, Inc. Integrated Systems Technologies, Inc. netkids Imark
Vendors & Products		Integrated Systems Technologies, Inc. Integrated Systems Technologies, Inc. netkids Imark

Wed, 05 Aug 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title		Uncontrolled Search Path Element Allows Authenticated System‑Level Code Execution in NetKids iMark

Wed, 05 Aug 2026 05:30:00 +0000

Type	Values Removed	Values Added
Description		NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.
Weaknesses		CWE-427
References		https://jvn.jp/en/jp/JVN28045338/ https://www.istinc.co.jp/dl/jpc/%E3%82%B5%E3%83%BC%E3%83%93%E3%82%B9%E3%81%AE%E5%AE%9F%E8%A1%8C%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%83%91%E3%82%B9%E3%81%8C%E5%BC%95%E7%94%A8%E7%AC%A6%E3%81%A7%E5%9B%B2%E3%81%BE%E3%82%8C%E3%81%A6%E3%81%84%E3%81%AA%E3%81%84%E3%81%93%E3%81%A8%E3%81%AB%E3%82%88%E3%82%8B%E6%A8%A9%E9%99%90%E6%98%87%E6%A0%BC%E3%81%AE%E5%95%8F%E9%A1%8C%E3%81%A8%E5%AF%BE%E5%BF%9C.pdf https://www.istinc.co.jp/dl/jpc/DLL%E3%83%95%E3%82%A1%E3%82%A4%E3%83%AB%E3%81%AE%E8%AA%AD%E3%81%BF%E8%BE%BC%E3%81%BF%E3%81%8A%E3%82%88%E3%81%B3%E3%82%A4%E3%83%B3%E3%82%B9%E3%83%88%E3%83%BC%E3%83%AB%E3%83%95%E3%82%A9%E3%83%AB%E3%83%80%E3%81%AE%E3%82%A2%E3%82%AF%E3%82%BB%E3%82%B9%E6%A8%A9%E9%99%90%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E5%95%8F%E9%A1%8C%E3%81%A8%E5%AF%BE%E5%BF%9C.pdf
Metrics		cvssV3_0 `{'score': 6.7, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 5.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Integrated Systems Technologies, Inc. Netkids Imark

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2026-08-05T04:25:58.310Z

Updated: 2026-08-05T13:33:27.938Z

Reserved: 2026-07-28T05:10:34.543Z

Link: CVE-2026-66344

Vulnrichment

Updated: 2026-08-05T13:33:24.409Z

NVD

Status : Received

Published: 2026-08-05T06:16:38.783

Modified: 2026-08-05T14:17:09.070

Link: CVE-2026-66344

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-05T10:18:37Z

Weaknesses

CWE-427
Uncontrolled Search Path Element

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object