CVE-2026-12780: AOMEI Backupper Kernel Driver Privilege Escalation Vulnerability

Technical summary

CVE-2026-12780 is a privilege escalation vulnerability in AOMEI Backuporter versions up to and including 8.3.0. The vulnerability exists within the amwrtdrv.sys kernel driver component, which implements improper access control logic (CWE-266, CWE-284). An authenticated local user can manipulate the driver's input or state to bypass security restrictions, achieving read, write, and execute access at kernel level. The attack vector is local with low complexity and no user interaction required once code execution begins. CVSS 3.1 score is 7.8 (HIGH), reflecting the severity of unrestricted kernel-level access from a user-mode entry point.

Business impact

Organizations relying on AOMEI Backupper for backup and recovery face significant risk. A compromised machine running vulnerable Backupper software could allow lateral movement, persistent malware installation, and data exfiltration via the backup infrastructure itself. For managed service providers and enterprises managing backup appliances, this vulnerability could be leveraged to corrupt, steal, or destroy backup data—negating the primary defense against ransomware. The lack of vendor responsiveness complicates patch deployment timelines.

Affected systems

AOMEI Backupper version 8.3.0 and all earlier versions are impacted. The vulnerability resides in a core kernel driver component, so any installation of a vulnerable version on Windows systems is at risk. Backups managed by compromised instances may also face integrity concerns. Organizations should audit their Backupper deployments immediately to identify affected systems.

Exploitability

The vulnerability is exploitable but requires local system access (a user account or remote desktop session). Public exploit code is available, lowering the barrier to weaponization. An attacker with standard user privileges can trigger the flaw without additional user interaction. This makes the vulnerability particularly dangerous in multi-tenant environments, shared lab systems, and scenarios where an adversary has already gained an initial foothold via phishing, supply-chain compromise, or other entry vector.

Remediation

Upgrade AOMEI Backupper to a patched version greater than 8.3.0 as soon as the vendor releases one. Until then, restrict local system access and monitor user login activity. Consider isolating backup infrastructure from general-purpose networks and implementing strict access controls on Backupper administrative functions. Monitor kernel driver loading and system-level file modifications on affected hosts.

Patch guidance

Watch AOMEI's official download and release notes pages for version 8.4.0 or later. Verify patch availability from the vendor's site before deploying—do not rely on third-party sources. Once patched versions are available, prioritize backup infrastructure for immediate update, as this is a critical trust boundary. Test patches in a non-production environment first to ensure backup integrity and recovery workflows remain functional.

Detection guidance

Monitor for unusual access patterns to the amwrtdrv.sys driver, such as direct device I/O control (IOCTL) calls from unexpected processes. Check Windows Event Viewer for privileged mode transitions and kernel-level errors originating from Backupper processes. Host-based threat detection should flag attempts to load or manipulate kernel drivers by non-admin user accounts. Network monitoring of backup traffic for unexpected data flows may indicate compromise of the backup system itself.

Why prioritize this

This vulnerability merits urgent priority because it grants kernel-level code execution from a user context, affecting the integrity of system backups—a critical last-line-of-defense security control. Public exploits eliminate the zero-day window. Backup systems are high-value targets for attackers seeking persistence and data destruction capabilities. Organizations without a patched version should treat this as an active threat requiring immediate remediation planning.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local-only attack requirement, low complexity, low privilege escalation, and high impact across confidentiality, integrity, and availability. While local-only access limits exposure in pure cloud or air-gapped environments, most organizations have users with local system access, making this a realistic and severe threat. The presence of public exploits and lack of vendor response further elevate operational risk.

Frequently asked questions