Fortinet Warns: A 5-Year-Old Firewall Flaw Is Still Letting Attackers Bypass 2FA
Two-factor authentication (2FA) is widely promoted as one of the strongest defenses against unauthorized access. Yet in late 2025, Fortinet issued a renewed warning that a vulnerability first disclosed in 2020 is still being actively exploited to bypass 2FA on FortiGate firewalls.
The flaw, tracked as CVE-2020-12812, affects FortiOS SSL VPN and allows attackers to authenticate without completing the second factor under certain configurations. What makes this situation particularly concerning is not the complexity of the attack — but its age. Five years later, it is still working.
A vulnerability that never really went away
Fortinet originally patched CVE-2020-12812 in July 2020. At the time, the issue was described as an “improper authentication” weakness that could allow attackers to log in by manipulating the capitalization of usernames.
In some FortiGate setups, particularly those using LDAP for authentication, the firewall does not consistently handle uppercase and lowercase usernames between local and remote authentication checks. When two-factor authentication is enabled in this configuration, the system can mistakenly allow a login without triggering the second factor at all.
Fortinet addressed the flaw in FortiOS versions 6.0.10, 6.2.4, and 6.4.1 and advised administrators who could not immediately patch to disable username case sensitivity as a temporary mitigation.
Despite this, Fortinet confirmed in December 2025 that attackers are actively exploiting the same vulnerability in the wild.
Why attackers are still succeeding
According to Fortinet, exploitation typically occurs in environments where:
- FortiGate VPN access is enabled
- LDAP authentication is in use
- Local user entries require 2FA
- Secondary or fallback LDAP groups remain configured
In these cases, authentication may succeed even when username matching fails, allowing attackers to bypass the second authentication factor entirely.
This is not a theoretical risk. The vulnerability has previously been abused by ransomware groups and state-aligned threat actors, and it has been listed by CISA as a known exploited vulnerability. Federal agencies were ordered to remediate it as far back as 2022.
Yet, as Fortinet’s latest advisory shows, misconfigurations, delayed upgrades, and legacy VPN setups continue to keep the door open.
Why VPN flaws are so dangerous
VPNs sit at the edge of the network. They are designed to provide trusted access — which makes them extremely valuable to attackers.
When a threat actor gains VPN access:
- They appear as a legitimate user
- Security controls may not trigger alerts
- Lateral movement becomes much easier
Many major ransomware incidents do not begin with malware, but with valid VPN credentials or authentication bypasses. Once inside, attackers can quietly explore the environment before deploying payloads or stealing data.
The uncomfortable truth about “old” vulnerabilities
One of the biggest misconceptions in cybersecurity is that age reduces risk. In reality, attackers often prefer older vulnerabilities because:
- Organizations stop monitoring for them
- Systems remain unpatched due to “business stability”
- Configuration drift goes unnoticed over time
CVE-2020-12812 is a textbook example. It is well-documented, widely known, and still effective against unmaintained systems.
What Fortinet customers should do now
Fortinet strongly recommends that organizations:
- Verify they are running a FortiOS version that fully addresses the issue
- Review LDAP and 2FA configurations carefully
- Remove unnecessary secondary LDAP groups
- Monitor VPN authentication logs for anomalies
Most importantly, organizations should not assume that enabling 2FA alone guarantees protection.
The bigger takeaway
Fortinet’s warning is not just about a single vulnerability. It is a reminder that security controls require ongoing care. Patches, configurations, and assumptions made years ago can quietly become today’s biggest risks.
A firewall installed in 2020 and “never touched again” is exactly what attackers look for.
Final thoughts
A five-year-old flaw should not still be breaking two-factor authentication — but here we are.
If your organization relies on VPN access, especially on FortiGate devices, this is a moment worth taking seriously. Attackers already know where to look. The question is whether defenders will check first.
