AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability

Published September 10, 2026 CVE-2026-12780

AOMEI Backupper can let a local user run code before Windows starts. When Secure Boot is disabled, this can bypass specified Windows security controls and may expose BitLocker protection data.

Severity
HighCVSS 3.1 · 7.8
Fix
Not confirmedLast checked today
Affected versions
8.0; 8.1; 8.2+1 more
Weakness
CWE-266
Exploit likelihood
0.16% in 30 daysEPSS, higher than 6% of known flaws
Affects
Backupper
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-38145ENISA vulnerability database

How it works

  • A local user can send disk-write requests through Backupper's driver.
  • The driver permits those requests without proper access checks.
  • This lets an attacker alter early startup data so code runs before Windows security protections load.
  • CERT/CC says the attack can bypass HVCI, EDR, Microsoft Defender, and Hyper-V isolation when Secure Boot is disabled.

What to do

Check the installed AOMEI Backupper version against the CERT/CC advisory and the CVE record. The reviewed sources disagree about whether 8.4.0 is affected, so ask your IT team or AOMEI for confirmation if that version is installed.

CERT/CC recommends updating to a release containing the corrected driver, but the supplied evidence gives no exact fixed version. If you cannot update immediately, CERT/CC recommends uninstalling AOMEI Backupper or disabling the amwrtdrv.sys service. Enabling Secure Boot adds protection but does not fix the driver.

Technical details

CVE-2026-12780 concerns improper access controls in AOMEI Backupper's amwrtdrv.sys driver. The CVE record lists 8.0, 8.1, 8.2, and 8.3.0 as affected, while CERT/CC describes the driver in 8.4.0 and recommends a corrected driver, uninstalling the product, or disabling its service.

Severity breakdown

  • Attack vector Local Needs local access to the machine
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source