CVE-2026-12780
AOMEI Backupper Kernel Driver amwrtdrv.sys access control
- State
- Published
- Severity
- 8.5 High
- Published
- Jun 21, 2026
- Updated
- Oct 13, 2026
- Reserved
- Jun 20, 2026
Description
A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.8 High | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.8 Medium | AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
BackupperAOMEI |
|
References
- VDB-372521 | AOMEI Backupper Kernel Driver amwrtdrv.sys access controlvdb-entry
- VDB-372521 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-12780 | CVE Analysis and Reportthird-party-advisory
- Submit #835609 | AOMEI AOMEI Backupper Kernel Driver amwrtdrv.sys 8.3.0 Local Privilege Escapationthird-party-advisory
- https://winslow1984.com/books/cve-collection/page/aomei-backupper-830-kernel-driver-amwrtdrvsys-local-privilege-escalationexploit
- https://www.kb.cert.org/vuls/id/687587
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.