# AOMEI Backupper driver flaw enables UEFI bypass

Published: 2026-09-10 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/3d527ad6-41ae-563c-86d5-99a56b0b2f48/aomei-backupper-driver-flaw-enables-uefi-bypass

> A world-writable kernel driver in AOMEI Backupper 8.4.0 lets local unprivileged users write raw disk sectors and plant malicious UEFI code, bypassing HVCI, EDR, and BitLocker protections.

CERT/CC has published an advisory (VU#687587) for CVE-2026-12780, an incorrect permission assignment vulnerability (CWE-732) in the amwrtdrv.sys kernel driver bundled with AOMEI Backupper 8.4.0. The driver exposes a device object (\\.\mwrtdrv\DISK0) without a security descriptor, meaning any unprivileged local process can open it and issue arbitrary write commands to physical disks. An attacker can abuse this to write to the pre-partition gap (LBA 34-2047), inject a malicious UEFI payload, and modify the GPT to point to it as an EFI System Partition, achieving code execution during the UEFI Boot Device Selection phase — before the OS or any of its security controls load.

The practical impact is significant for endpoints where Secure Boot is disabled: attackers can bypass Hyper-V Code Integrity, EDR agents, and Windows Defender entirely, since the payload runs pre-OS. On systems using BitLocker with TPM-only protection (no PIN), this also opens an evil-maid attack path to capture the Volume Master Key during pre-boot. There is no indication in the advisory of in-the-wild exploitation; this is a vulnerability disclosure requiring local access, credited to researcher SiCk / afflicted.sh.

Defenders running AOMEI Backupper 8.4.0 should update to a patched version once available from AOMEI that corrects the driver's access controls. Interim mitigations include uninstalling AOMEI Backupper, or disabling the amwrtdrv.sys service (setting its start type from AUTO_START to disabled). Enabling Secure Boot provides defense-in-depth by requiring signed bootloaders but does not fix the underlying driver flaw, and BitLocker should be configured with a PIN/TPM+PIN rather than TPM-only where feasible to reduce evil-maid exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2026-12780

## Detection guidance (public sample)

### Suspicious Write to Physical Disk via Vulnerable AOMEI Driver

ATT&CK: T1542.005

Detects unprivileged process opening the vulnerable amwrtdrv.sys device object and issuing raw disk write commands to physical disk, enabling UEFI bootkit injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Write to Physical Disk via Vulnerable AOMEI Driver
description: Detects attempts to open and write to the \\?\GLOBALROOT\Device\mwrtdrv\DISK0
  device object exposed by vulnerable AOMEI Backupper amwrtdrv.sys driver. This behaviour
  is consistent with pre-partition gap UEFI payload injection attacks.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1542.005
- attack.t1542.003
- attack.t1068
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \\?\GLOBALROOT\Device\mwrtdrv
    - \\Device\mwrtdrv
    Image|endswith:
    - .exe
    - .dll
  filter_aomei_service:
    Image|contains: AOMEI
  condition: selection and not filter_aomei_service
falsepositives:
- AOMEI Backupper maintenance and backup tasks during normal operation
level: critical
id: dd1ac897-e9e8-5c35-bd67-784992fc8f43
status: experimental
author: Vorant
```

### Amwrtdrv.sys Service Auto-Start Enabled

ATT&CK: T1542.003

Detects when the vulnerable amwrtdrv.sys kernel driver service is configured to auto-start, leaving the unprivileged device endpoint exposed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Amwrtdrv.sys Service Auto-Start Enabled
description: Detects registry modification setting the amwrtdrv.sys service start
  type to AUTO_START or BOOT_START. Vulnerable versions expose the device object without
  security descriptors, allowing unprivileged UEFI bootkit injection.
tags:
- attack.persistence
- attack.t1542.003
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
    - Services\amwrtdrv\Start
    - Services\mwrtdrv\Start
    Details:
    - '0'
    - '2'
  condition: selection
falsepositives:
- AOMEI Backupper installer or update enabling the driver service
level: high
id: ef53dab0-582b-5d0d-b8c6-20b84194698d
status: experimental
author: Vorant
```

### Unprivileged Process Accessing Vulnerable AOMEI Kernel Driver Device Object

ATT&CK: T1068

Detects non-system processes opening the amwrtdrv.sys device object without elevated privileges, exploiting CWE-732 incorrect permission assignment for disk write access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unprivileged Process Accessing Vulnerable AOMEI Kernel Driver Device Object
description: Detects CreateFile/CreateFileW calls targeting the \\?\GLOBALROOT\Device\mwrtdrv
  device object from non-SYSTEM processes. The vulnerable AOMEI Backupper 8.4.0 driver
  exposes this device without a security descriptor, allowing any unprivileged process
  to issue arbitrary disk writes.
tags:
- attack.privilege-escalation
- attack.defense-evasion
- attack.t1068
- attack.t1542.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
    - mwrtdrv
    - DISK0
    - \\?\GLOBALROOT\Device
    User|endswith:
    - BUILTIN\Users
    - BUILTIN\Interactive
  filter_aomei_backup:
    ParentImage|contains: AOMEI
  condition: selection and not filter_aomei_backup
falsepositives:
- Legitimate AOMEI Backupper backup or restore operations under standard user context
level: high
id: 3daea80b-3f96-5494-b34a-55f8b4114ab1
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/687587

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3d527ad6-41ae-563c-86d5-99a56b0b2f48/aomei-backupper-driver-flaw-enables-uefi-bypass.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup