High

Cybercriminals are actively exploiting a long-patched Fortinet FortiGate vulnerability (FG-IR-19-283 / CVE-2020-12812) first disclosed in July 2020 to bypass two-factor authentication (2FA) on affected firewalls. Researchers recently confirmed real-world attacks, warning that misconfigured or unpatched FortiGate devices can allow attackers to gain unauthorized access to SSL/IPsec VPNs and even administrative interfaces. Despite fixes being available for years, the flaw remains exploitable due to configuration drift and outdated firmware still deployed in production environments.

The vulnerability arises from a mismatch in username handling between FortiGate and LDAP-based identity systems such as Active Directory. FortiGate treats usernames as case-sensitive by default, while LDAP generally does not. In environments where local FortiGate users have 2FA enabled and are also members of LDAP groups mapped to authentication or firewall policies, attackers can abuse this behavior. By logging in with a case-variant username (e.g., “Jsmith” instead of “jsmith”), FortiGate fails to match the local 2FA-protected account and instead falls back to LDAP-based authentication, where valid credentials alone are sufficient effectively bypass 2FA.

Fortinet confirmed that exploitation requires three conditions: a local FortiGate user with 2FA enabled and referencing LDAP, membership of that user in LDAP groups configured on FortiGate, and those groups being used in firewall policies for VPN or admin access. Successful exploitation may grant VPN access or elevated privileges without any token verification. Fortinet stresses that any confirmed bypass should be treated as a full compromise, recommending immediate credential resets (including LDAP/AD binding accounts) and careful log analysis for indicators such as failed local authentication followed by successful LDAP logins.

To mitigate the risk, Fortinet urges administrators to upgrade to patched versions (FortiOS 6.0.10+, 6.2.4+, or 6.4.1+). For environments that cannot immediately patch, disabling username case sensitivity can neutralize the attack path by normalizing username comparisons. Additional hardening steps include removing unnecessary LDAP groups from authentication policies and actively auditing logs for case-variant login attempts. This campaign highlights how legacy flaws continue to pose serious threats when combined with misconfigurations, reinforcing the need for strict access control, regular audits, and timely patch management to prevent attackers from exploiting overlooked weaknesses.