10,000+ Fortinet Firewalls Still Exposed to 5-year Old MFA Bypass Vulnerability

Over 10,000 FortiGate firewalls remain vulnerable to CVE-2020-12812, an MFA bypass in FortiOS SSL VPN portals caused by case-sensitivity mismatches between local usernames and LDAP; attackers can bypass second-factor authentication by altering username case. Fortinet confirmed active abuse in late 2025, Shadowserver reports widespread exposure, and Fortinet urges upgrades to patched FortiOS versions and configuration checks to mitigate lateral movement and ransomware risk.