CVE-2026-12780: AOMEI Backupper Privilege Escalation Flaw

CVE-2026-12780 Overview

CVE-2026-12780 is a local privilege escalation vulnerability in AOMEI Backupper versions up to 8.3.0. The flaw resides in the amwrtdrv.sys kernel driver and stems from improper access controls [CWE-266]. A local attacker with low privileges can interact with the driver to perform operations that should be restricted to higher-privileged contexts. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. According to the VulDB entry, the vendor was notified prior to disclosure but did not respond.

Critical Impact
Local attackers can abuse the amwrtdrv.sys kernel driver to bypass access controls and compromise confidentiality, integrity, and availability of the affected Windows host.

Affected Products

AOMEI Backupper up to and including version 8.3.0
Kernel driver component amwrtdrv.sys
Windows hosts where the vulnerable driver is installed and loaded

Discovery Timeline

2026-06-21 - CVE-2026-12780 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12780

Vulnerability Analysis

The vulnerability affects the amwrtdrv.sys kernel driver shipped with AOMEI Backupper through version 8.3.0. The driver exposes functionality that does not enforce sufficient access controls on incoming requests from user-mode callers. A low-privileged local user can open a handle to the driver and issue requests that the driver processes without verifying whether the caller is authorized. Because kernel drivers operate in ring 0, any operation the driver performs on behalf of an unprivileged caller can affect the integrity of the operating system.

The weakness is categorized as [CWE-266] Incorrect Privilege Assignment. Exploitation does not require remote network access or user interaction beyond running an exploit binary on the target system.

Root Cause

The amwrtdrv.sys driver fails to properly restrict which security principals can invoke its privileged operations. Drivers commonly enforce access through restrictive device object DACLs or by validating the caller's token inside IRP_MJ_CREATE and IRP_MJ_DEVICE_CONTROL handlers. In this case, the driver permits standard users to reach code paths that operate with kernel privileges, producing an avenue for privilege escalation.

Attack Vector

Exploitation requires local access and low privileges on a host where AOMEI Backupper is installed and the amwrtdrv.sys driver is loaded. An attacker opens a handle to the driver's device object and sends crafted I/O control requests to invoke the unrestricted functionality. Public disclosure of the exploit lowers the barrier for adoption by commodity malware and post-exploitation toolkits seeking to elevate from a standard user to SYSTEM. No verified exploit code is referenced in NVD; see the VulDB CVE-2026-12780 entry and the Winslow Blog write-up for additional technical context.

Detection Methods for CVE-2026-12780

Indicators of Compromise

Presence of amwrtdrv.sys on hosts where AOMEI Backupper is not an approved application.
Unexpected loading of the amwrtdrv service or driver outside scheduled backup windows.
Standard user processes opening handles to the \\.\amwrtdrv device object.
Creation of SYSTEM-level processes parented to non-administrative user sessions following driver access.

Detection Strategies

Inventory endpoints for the amwrtdrv.sys file and the associated driver service to identify exposed hosts.
Hunt for DeviceIoControl calls targeting the AOMEI driver from non-AOMEI processes.
Correlate token elevation events with prior interaction with the amwrtdrv device object.
Apply Microsoft's vulnerable driver blocklist and monitor for attempts to load drivers that match known abused versions.

Monitoring Recommendations

Enable Windows Defender Application Control or WDAC-equivalent policies in audit mode to log driver loads.
Forward Sysmon Event IDs 6 (driver loaded) and 1 (process create) to a centralized analytics platform for correlation.
Alert on user-mode access to kernel device objects belonging to backup or imaging products on systems where those products are not authorized.

How to Mitigate CVE-2026-12780

Immediate Actions Required

Identify all hosts running AOMEI Backupper 8.3.0 or earlier and restrict their use to trusted administrators only.
Stop and disable the amwrtdrv service on systems where AOMEI Backupper is not actively required.
Add amwrtdrv.sys to the Microsoft vulnerable driver blocklist on endpoints that do not need the product.
Limit interactive logons on affected hosts to reduce the local attack surface until a vendor patch is available.

Patch Information

No vendor patch is referenced in the published advisory. According to the VulDB submission, the vendor was contacted early about this disclosure but did not respond. Administrators should monitor AOMEI's product release notes and the VulDB CVE-2026-12780 entry for updates and consider removing the product where alternatives exist.

Workarounds

Uninstall AOMEI Backupper on systems that do not require it and verify removal of amwrtdrv.sys.
Enforce least privilege so that standard users cannot run arbitrary executables that target the driver.
Apply the Microsoft recommended driver blocklist policy to prevent loading of the vulnerable driver.
Use application control policies to restrict execution of unsigned or untrusted binaries that could invoke the driver.

bash

# Example: disable the amwrtdrv service on an affected Windows host
sc.exe query amwrtdrv
sc.exe stop amwrtdrv
sc.exe config amwrtdrv start= disabled