Fortinet Warns of Active Exploitation of FortiOS SSL VPN 2FA Bypass Vulnerability

Fortinet has said it observed “recent abuse” in the wild of a five‑year‑old FortiOS SSL VPN flaw, CVE‑2020‑12812 (CVSS 5.2), that could let a user log in without triggering the second factor when the username’s case is not exact.

According to the latest advisory issued on 24 December 2025, exploitation requires a configuration in which local users with 2FA reference LDAP, the LDAP group is present, and the authentication policy includes the LDAP group, enabling LDAP to bypass the local 2FA if the FortiGate treats usernames as case‑sensitive while the LDAP Directory does not.

The issue has been linked to several attacks by multiple threat actors in years past, and Fortinet notes continued risk if organisations have not deployed fixed FortiGate versions. Mitigations include commands such as set username-case-sensitivity disable for older FortiOS 6.x releases and set username-sensitivity disable for versions 6.0.13, 6.2.10, 6.4.7, 7.0.1 or later, plus guidance to remove an unnecessary secondary LDAP Group and to reset credentials if evidence of 2FA‑free admin or VPN logins appears.