Fortinet Warns of Active Exploitation of CVE-2020-12812 in FortiOS SSL VPN

On December 24, 2025, Fortinet issued a warning regarding the exploitation of CVE-2020-12812, an improper authentication vulnerability in its FortiOS SSL VPN. This vulnerability, which has a CVSS score of 5.2, allows users to log in without being prompted for a second factor of authentication if the username’s case is altered. The issue arises when two-factor authentication is enabled in the ‘user local’ setting, while the user authentication type is set to a remote method like LDAP.

Fortinet noted that the vulnerability has been actively exploited by multiple threat actors, with the U.S. government listing it as a significant weakness in perimeter-type devices during 2021. The exploitation requires specific configurations, including local user entries on FortiGate with 2FA that reference LDAP, and users must belong to a group on the LDAP server.

When these conditions are met, the vulnerability allows LDAP users with 2FA to bypass security measures and authenticate directly against LDAP. This occurs because FortiGate treats usernames as case-sensitive, while LDAP does not. For example, a login attempt with ‘Jsmith’ will fail against a local user named ‘jsmith’, prompting FortiGate to check other configured authentication policies.

Fortinet released patches for FortiOS in July 2020 to address this issue, specifically versions 6.0.10, 6.2.4, and 6.4.1. Organizations that have not updated to these versions are advised to disable username case sensitivity to prevent this bypass. Customers on later versions are also encouraged to run a command to disable username sensitivity.

As a precaution, Fortinet recommends removing unnecessary secondary LDAP groups to eliminate potential attack vectors. While the advisory does not detail the nature of attacks exploiting this flaw, organizations should remain vigilant and reset credentials if unauthorized access is suspected.

Understanding the Risk

This vulnerability highlights the importance of proper configuration in authentication systems. Organizations using FortiOS should ensure that their settings align with best practices to avoid similar issues. The case sensitivity problem can lead to significant security risks if not addressed, particularly for admin or VPN users.

As cyber threats continue to evolve, it is crucial for organizations to regularly review their security configurations and stay updated on vulnerabilities affecting their systems. Monitoring access logs and implementing robust authentication policies can help mitigate risks associated with such vulnerabilities.