CVE-2020-12812

medium Fortinet ⚠️ CISA KEV — Exploited in the Wild
EPSS Score
49.3%
Exploitation probability in 30 days
Top 1% most likely to be exploited
Published: July 24, 2020 (2234 days ago)
Last Modified: August 12, 2026
Vendor: Fortinet
Source: MITRE

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2021-11-03
Remediation Due: 2022-05-03 (⚠ 1587d overdue)
Ransomware Campaign: Known

Description

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Affected Products

n/a Fortinet FortiOS

References

🔗 fortiguard.com