CVE-2026-66839: NetKids iMark RCE Vulnerability

CVE-2026-66839 Overview

CVE-2026-66839 is an unquoted search path vulnerability [CWE-428] in NetKids iMark, a software product provided by Integrated Systems Technologies, Inc. (IST). The flaw exists because the Windows service registered by the application does not enclose its executable path in quotation marks. An authenticated local attacker with sufficient write access to a directory along the unquoted path can place a malicious executable that Windows will launch under the SYSTEM account.

Critical Impact
An authenticated local attacker can achieve arbitrary code execution with SYSTEM privileges, resulting in full compromise of the affected Windows host.

Affected Products

NetKids iMark (Integrated Systems Technologies, Inc.)
Windows installations running the affected service configuration
Specific fixed versions are documented in the vendor advisories

Discovery Timeline

2026-08-05 - CVE-2026-66839 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-66839

Vulnerability Analysis

The vulnerability stems from how NetKids iMark registers its Windows service. When a service ImagePath value contains spaces and is not wrapped in double quotes, the Windows Service Control Manager (SCM) parses the path token by token. For each space it encounters, SCM attempts to execute a binary matching the truncated prefix, appending .exe.

For example, an ImagePath of C:\Program Files\Vendor\Sub Dir\service.exe will cause SCM to try C:\Program.exe, then C:\Program Files\Vendor\Sub.exe, before reaching the intended binary. If any of these preceding paths is writable by a lower-privileged user, that user can drop a payload that SCM will execute at service start.

Because NetKids iMark runs its service as LocalSystem, any binary launched through this hijack inherits SYSTEM-level privileges. The result is a straight-forward local privilege escalation primitive.

Root Cause

The root cause is improper quoting of the service binary path during installation. The installer registers the service without wrapping the path containing spaces in quotes, leaving the parsing behavior of Windows SCM open to abuse. Vendor documentation also identifies weak filesystem access controls on the DLL and installation folder as contributing factors.

Attack Vector

Exploitation requires local access with authenticated user privileges on the target host. The attacker identifies the unquoted service path, confirms write permissions on a parent directory, drops a crafted executable named to match a truncated prefix (for example Program.exe or Sub.exe), and waits for the service to restart or triggers a reboot. On next service start, Windows executes the attacker binary as SYSTEM. No network access and no user interaction beyond the attacker's own session are required.

Technical detail is described in the JVN Vulnerability Report and the vendor analyses on service execution path quoting and DLL access rights.

Detection Methods for CVE-2026-66839

Indicators of Compromise

Presence of unexpected executables such as Program.exe in the root of C:\ or intermediate directories along a service path
Newly created binaries in the NetKids iMark installation directory that predate a service restart or reboot event
Windows Service Control Manager (Event ID 7045 or 7000) entries showing service start from an unexpected image path
Child processes of services.exe running as SYSTEM but originating from user-writable directories

Detection Strategies

Enumerate services with wmic service get name,pathname,startmode and flag any PathName containing spaces that is not enclosed in double quotes
Audit ACLs on every directory in the service path; alert when a non-privileged principal has write or modify rights
Correlate service start events with process creation events (Sysmon Event ID 1) to detect anomalous SYSTEM-level binaries executed via SCM

Monitoring Recommendations

Continuously monitor file writes to root drives and vendor installation directories where write access should be restricted
Alert on SYSTEM-level process creation with parent services.exe where the image path does not match a known service binary
Log and review changes to Windows service configuration under HKLM\SYSTEM\CurrentControlSet\Services

How to Mitigate CVE-2026-66839

Immediate Actions Required

Apply the fix published by Integrated Systems Technologies, Inc. as referenced in the JVN advisory JVN28045338
Inventory all hosts running NetKids iMark and confirm the service ImagePath is now enclosed in double quotes
Restrict write access on all directories in the service path to Administrators and SYSTEM only
Review the installation folder and DLL search paths for weak ACLs per vendor guidance

Patch Information

Integrated Systems Technologies, Inc. has published remediation guidance in two PDF advisories addressing both the unquoted service path and the DLL and installation folder access rights. Refer to the IST analysis on service implementation and the IST analysis on DLL file access rights for the fixed version and configuration instructions.

Workarounds

Manually edit the service ImagePath in the registry to wrap the full path in double quotes, then restart the service
Tighten NTFS permissions on the installation directory and every parent folder to remove write access for standard users
Restrict interactive logon on affected hosts to reduce the population of local accounts able to stage a payload

bash

# Configuration example: query and correct an unquoted service path on Windows
# Identify services with unquoted paths containing spaces
wmic service get name,pathname,startmode | findstr /i /v "\"" | findstr /i /r /c:"[A-Za-z]:\\[^\"]* [^\"]*\\"

# Fix a specific service by re-registering its ImagePath with quotes
sc config "NetKidsiMarkService" binPath= "\"C:\Program Files\IST\NetKids iMark\service.exe\""

# Restrict write access on the install directory
icacls "C:\Program Files\IST\NetKids iMark" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"