CISA alerts on AOMEI Backupper amwrtdrv.sys physical disk writes
48th article in the last 90 days, one of 603 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA identifies SSRF in ONLYOFFICE ownCloud integration plugin (Sep 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Security Operations
- Persona
- Security Operations Practitioner
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Late Majority
- Technology maturity
- Established Technology
- Industry
- Information Technology / Software & Services / Cybersecurity / Governance, Risk & Compliance (GRC) & Security Ratings
Our classification, not the publisher's statement. Best suited for, not only for.
An incorrect permissions assignment in the amwrtdrv.sys kernel driver included with AOMEI Backupper 8.4.0 can allow an unprivileged local user to write to physical disk storage. With Secure Boot disabled, the issue can be used to execute arbitrary UEFI-level code before the operating system loads, bypassing OS-level security controls.
For CVE-2026-12780 (Incorrect Permission Assignment for Critical Resource, CWE-732), the driver creates a world-accessible device object without a security descriptor, enabling any user-mode process to open the device and issue unrestricted write requests. This allows an attacker to modify disk sectors in the pre-partition gap (LBA 34–2047), inject a malicious UEFI payload, and alter the GPT to reference the payload as an EFI System Partition. The payload can then execute during the UEFI Boot Device Selection (BDS) phase before operating system security mechanisms are loaded. Exploitation is described as opening the \\.\mwrtdrv\DISK0 device object and sending specially crafted write commands to an arbitrary physical disk.
With Secure Boot disabled, successful exploitation enables injection of UEFI code that executes before the Windows kernel loads and bypasses kernel-mode security features, including Hyper-V Code Integrity (HVCI), Endpoint Detection and Response (EDR) solutions, Windows Defender, and Hyper-V isolation. On systems using BitLocker with TPM-only protection, the attack vector can enable evil maid attacks in which VMK credentials can be captured during the pre-boot phase during the Boot Device Selection (BDS) phase.
Please see the Vendor Information section for patches provided by AOMEI International Network Limited to address this issue. CERT/CC recommends that AOMEI Backupper users update to a version that includes the corrected amwrtdrv.sys driver and implements appropriate access controls. For users unable to apply the available update immediately, the guidance says they should consider uninstalling AOMEI Backupper. It also states that alternatively, users may disable the amwrtdrv.sys service by changing its start type from AUTO_START to disabled. The guidance further states that enabling Secure Boot in UEFI settings provides additional defense in depth by requiring signed bootloaders, but does not address the underlying driver vulnerability.
Vijay Sarvepalli authored the document. The advisory includes an acknowledgement thanking SiCk / afflicted.sh for reporting the vulnerability.
Blog post, originally published by Vijay Sarvepalli at kb.cert.org.