CVE-2026-66344 describes an Uncontrolled Search Path Element vulnerability in NetKids iMark by Integrated Systems Technologies, Inc. This flaw allows an authenticated attacker with low privileges to execute arbitrary code with SYSTEM-level privileges by exploiting the way the application handles search paths. The vulnerability requires user interaction and local access, limiting remote exploitation. No vendor advisory or patch information is currently available.

Successful exploitation enables an authenticated attacker with low privileges to execute arbitrary code with SYSTEM privileges, potentially leading to full system compromise. The attack requires user interaction and local access, which reduces the likelihood of remote exploitation but still poses a significant risk in environments where attackers can gain authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to trusted users only and monitor for suspicious activity related to code execution attempts. Avoid running the application with elevated privileges where possible.