Which versions of AOMEI Partition Assistant are affected by CVE-2026-12778?

AOMEI Partition Assistant versions through 10.10.1 contain a local privilege escalation vulnerability (CVSS 7.1) allowing authenticated low-privilege users to achieve SYSTEM-level code execution,…

Is there a public PoC exploit available for CVE-2026-12778?

Yes, a public proof-of-concept exploit is available for CVE-2026-12778. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12778?

24 hours: Inventory all systems running AOMEI Partition Assistant version 10.10.1 or earlier; identify which host authenticated low-privilege user access. 7 days: Restrict AOMEI Partition Assistant execution to administrative accounts only via application allowlisting or AppLocker policies; initiate evaluation of alternative partition management solutions. 30 days: Deploy replacement disk management software or establish permanent application usage restrictions; document business justification and compensating controls for any retained installations.

AOMEI Partition Assistant CVE-2026-12778

Q: What is the CVSS score of CVE-2026-12778?

CVE-2026-12778 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38143 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-9fg6-8666-rx55

Authentication Bypass Partition Assistant Aomei

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local attack by an authenticated low-privileged user exploiting a kernel driver IOCTL with no user interaction, yielding full CIA impact via SYSTEM-level code execution.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:55 vuln.today

CVSS changed

Jun 21, 2026 - 06:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in AOMEI Partition Assistant through version 10.10.1 allows authenticated low-privileged users to abuse improper access controls in the ampa10.sys kernel driver to gain SYSTEM-level code execution. Publicly available exploit code exists per VulDB, and the vendor did not respond to coordinated disclosure attempts, leaving installations exposed; no public exploit identified at time of analysis as actively used in the wild (not in CISA KEV).

Technical ContextAI

AOMEI Partition Assistant is a Windows disk and partition management utility that installs a signed kernel-mode driver, ampa10.sys, to perform privileged disk operations on behalf of user-mode components. The flaw is classified as CWE-284 (Improper Access Control), meaning the driver exposes IOCTL handlers or device objects without adequately restricting which callers can invoke privileged operations. Because the driver runs in Ring 0, any unprivileged user able to open a handle to the device can issue requests that the driver executes with full kernel privilege - a classic 'BYOVD'-adjacent or vulnerable-driver pattern. The affected CPE is cpe:2.3:a:aomei:partition_assistant:*:*:*:*:*:*:*:* with EUVD confirming versions 10.10.0 and 10.10.1.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor did not respond to the VulDB disclosure. As a compensating control, uninstall AOMEI Partition Assistant on hosts where it is not actively required, since the vulnerable ampa10.sys driver is loaded whenever the product is installed (trade-off: loss of partition management capability). Where the product must remain, block loading of ampa10.sys via Windows Defender Application Control (WDAC) or Microsoft's vulnerable driver blocklist once the hash is added, and restrict local logon to trusted administrators only; note this will break Partition Assistant functionality. Monitor EDR for handle opens to the ampa10 device object from non-administrative processes as a detection backstop. Track https://vuldb.com/vuln/372519 and the vendor site for any future patched release.