AOMEI Backupper CVE-2026-12780

Requires local code execution on a Windows endpoint that has AOMEI Backupper 8.0-8.3.0 installed with its amwrtdrv.sys kernel driver loaded, and the attacker must already hold at least an unprivileged interactive or service account on that host (CVSS PR:L). Limiting factors per the CVSS 4.0 vector: no remote exploitation (AV:L), no user interaction is needed beyond the attacker's own session (UI:N), and the attack is confined to the vulnerable system (SC:N/SI:N/SA:N); systems where the AOMEI Backupper service/driver is not installed, or where the driver has been blocked via WDAC/Microsoft Vulnerable Driver Blocklist, are not exploitable.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and E:P (proof-of-concept) accurately characterizes a local privilege-escalation issue: an attacker must already execute code on the host as a normal user, but exploitation is low-complexity and yields full confidentiality, integrity, and availability impact (effectively SYSTEM/kernel). The publicly disclosed exploit write-up at winslow1984.com raises the practical risk meaningfully, since attackers no longer need to reverse the driver themselves; however, the issue is not listed on CISA KEV and no EPSS score was provided, so widespread mass exploitation is not confirmed. The most important caveat is the vendor's lack of response: there is no confirmed patched version, so risk reduction depends on workarounds rather than upgrading. This is a meaningful priority for endpoints where AOMEI Backupper is deployed alongside untrusted users or where initial-access malware is realistic, and a lower priority for tightly controlled single-user workstations.

An attacker who has obtained low-privileged code execution on a Windows host running AOMEI Backupper (for example, via a phishing payload running as a standard user) opens a handle to the amwrtdrv.sys device object and issues the IOCTLs documented in the public PoC to perform arbitrary kernel reads/writes or to overwrite a privileged process token, elevating the current process to NT AUTHORITY\SYSTEM. The publicly disclosed write-up provides the technique and primitives, so weaponization effort is low for any actor already on the box.