November 3, 2021 · Applied Cybernetics Group
CVE-2020-12812 — Fortinet FortiOS
known ransomware use
Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
- Added to KEV
2021-11-03- Federal due date
2022-05-03- Vendor
- Fortinet
- Product
- FortiOS
- EPSS
- 98.8th percentile (score 0.493, as of
2026-09-16) - NVD CVSS v3.1
- 9.8 (CRITICAL)
- Ransomware use
- Known
- ATT&CK
- T1556 · signal rollup
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2020-12812
CISA short description
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
Required action
Apply updates per vendor instructions.
NVD description
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.