CVE-2026-12778: Local Privilege Escalation in AOMEI Partition Assistant

How to Detect It

Detection for this CVE is not as straightforward as scanning a web log for a URL. The abuse path is local and driver-based, so defenders need to combine asset identification, driver load monitoring, and behavioral indicators of unusual raw disk access. Start by identifying systems where AOMEI Partition Assistant is installed or where ampa10.sys is present or loaded. Then review whether those systems are used by multiple local users, developers, helpdesk staff, or any population where a non-admin foothold is plausible.

The next layer is telemetry. Because the public writeup indicates access via \\.\wowrt, defenders should hunt for process activity involving that string, suspicious access to physical disk paths, and service or driver state changes involving AOMEI components. Raw disk manipulation from unexpected user processes is especially suspicious on workstations. If your EDR captures device object access, file handle telemetry, command lines, or kernel driver events, build detections around those data sources.

Technical Notes

PowerShell example to identify the installed binary and basic metadata:

Get-Item "C:\Windows\System32\drivers\ampa10.sys" | Select-Object FullName, Length, CreationTime, LastWriteTime, VersionInfo

Windows event and telemetry hunting ideas:

DeviceImageLoadEvents
| where FileName =~ "ampa10.sys"
| project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, SHA1, Signer

DeviceProcessEvents
| where ProcessCommandLine has_any ("wowrt", "PhysicalDrive", "Partition0")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine

DeviceFileEvents
| where FolderPath has @"\System32\drivers\ampa10.sys"
   or FileName =~ "ampa10.sys"
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, FolderPath, SHA1

Concrete log or pattern to monitor if your tooling exposes device path access:

\\.\wowrt
\\.\wowrt\Partition0\DISK
\\.\PhysicalDrive

Sigma-style concept for EDRs that capture suspicious command line or API usage:

title: Possible Abuse of AOMEI wowrt Device
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - '\\.\wowrt'
      - '\\.\PhysicalDrive'
      - 'Partition0\DISK'
  condition: selection
level: high

If your tools do not expose device object access, assume detection coverage is limited and prioritize removal or containment over attempting perfect detection.

Mitigation and Patching

The most important limitation here is that no verified fixed version is publicly confirmed in the reviewed sources. The NVD notes that the vendor was contacted but did not respond, and no trustworthy advisory with a remediated version number was identified. Because of that, defenders should not publish or rely on an unverified “fixed in version X” claim. The safe statement is: affected versions are up to 10.10.1, and a fixed version is unknown from currently reviewed public sources.

Operationally, mitigation means reducing exposure from the vulnerable driver. If AOMEI Partition Assistant is not required, uninstalling the software and confirming the driver is removed is the cleanest response. If it is required for a business process, restrict local access to those systems, reduce opportunities for untrusted code execution, and consider disabling the vulnerable driver or service if that does not break essential operations. On shared workstations and servers, local privilege escalation flaws deserve higher urgency because a single low-privilege foothold can become full host compromise.

Technical Notes

If installed via standard Windows package management, first inventory and remove the product where possible:

Get-Package | Where-Object { $_.Name -match "AOMEI|Partition Assistant" }

If a package entry is available, uninstall through Apps/Features, enterprise software management, or the package’s registered uninstaller. Then verify the driver file is gone:

Test-Path "C:\Windows\System32\drivers\ampa10.sys"

If immediate removal is not possible, inspect and stop the driver service if present:

sc query type= driver | findstr /i "ampa aomei wowrt"
sc stop ampa10
sc config ampa10 start= disabled

On systems where the service name differs, identify it first:

Get-CimInstance Win32_SystemDriver | Where-Object { $_.PathName -match "ampa10\.sys" } | Select-Object Name, State, StartMode, PathName

As a workaround, restrict software execution and local logon paths on hosts where the product remains installed. AppLocker or WDAC will not fix the driver bug directly, but they can reduce the chance that a low-privilege user can run custom tooling to abuse it.

References

For further reading, check our articles on what a SOC does and vulnerability management triage workflows.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.