Which versions of AOMEI Backupper are affected by EUVD-2026-38145?

AOMEI Backupper (versions through 8.3.0) contains a kernel driver vulnerability allowing any authenticated local user to escalate privileges on affected systems.

Is there a public PoC exploit available for EUVD-2026-38145?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38145. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-38145?

Within 24 hours: Inventory all systems running AOMEI Backupper 8.3.0 and earlier; restrict local user account creation and service account privileges on affected systems. Within 7 days: Deploy endpoint detection and response (EDR) to monitor for privilege escalation attempts and suspicious kernel driver access; establish escalation path with AOMEI for patch timeline; audit local account permissions. Within 30 days: Evaluate alternative backup solutions; if remaining on AOMEI, implement privileged access management (PAM) controls and kernel driver monitoring; develop migration plan if patch not released.

AOMEI Backupper EUVD-2026-38145

Q: What is the CVSS score of EUVD-2026-38145?

EUVD-2026-38145 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-12780 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-6373-275m-34g3

Authentication Bypass Backupper Aomei

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local-only attack against an installed kernel driver requires an existing low-privileged session (AV:L, PR:L, AC:L, UI:N); successful exploitation yields full kernel/SYSTEM impact (C:H/I:H/A:H, scope unchanged).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:56 vuln.today

CVSS changed

Jun 21, 2026 - 06:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in AOMEI Backupper through 8.3.0 stems from improper access controls in the bundled kernel driver amwrtdrv.sys, allowing an authenticated local user to abuse driver IOCTLs and escalate privileges. Publicly available exploit code exists for this issue, and the vendor was contacted but has not responded, leaving customers without an official fix. The CVSS 4.0 base score is 7.1 with local attack vector and low privileges required, reflecting realistic post-foothold risk rather than remote compromise.

Technical ContextAI

AOMEI Backupper is a Windows backup and disaster-recovery product that installs amwrtdrv.sys, a kernel-mode driver used to perform privileged disk and volume operations on behalf of the user-mode service. The flaw maps to CWE-284 (Improper Access Control), a class of weakness in which a driver exposes a device object or IOCTL interface without adequately restricting which callers may invoke it or which operations they may request. In practice, such drivers commonly grant low-integrity processes the ability to issue read/write or memory-mapping IOCTLs that the driver then performs in kernel context, turning the trusted driver into a confused-deputy primitive (a typical BYOVD-style local privilege escalation pattern). The affected CPE is cpe:2.3:a:aomei:backupper:*:*:*:*:*:*:*:* covering versions 8.0, 8.1, 8.2, and 8.3.0 per ENISA EUVD EUVD-2026-38145.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor was contacted early but did not respond. As a primary compensating control, remove or uninstall AOMEI Backupper on endpoints where it is not strictly required, since this also removes the vulnerable amwrtdrv.sys driver; where the product must remain, block loading of the specific vulnerable driver via Microsoft's Vulnerable Driver Blocklist or a WDAC/AppLocker policy that denies amwrtdrv.sys by hash, accepting the trade-off that AOMEI Backupper's backup and restore functionality will break until the vendor ships a fixed driver. Restrict local logon and interactive access on systems running the product to trusted administrators only, monitor for the public PoC technique documented at https://winslow1984.com/books/cve-collection/page/aomei-backupper-830-kernel-driver-amwrtdrvsys-local-privilege-escalation, and track the VulDB advisory at https://vuldb.com/vuln/372521 for any future patched release.