high 7.5

CVE-2020-12812 kev+ ransomware in the critical feed json

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to lo…

published 2020-07-24 6y ago modified 2026-10-02 last mo. also EUVD-2020-5095

cvss: 7.5; version 3.1, CNA
cisa kev: Exploited; added 2021-11-03, used in ransomware
epss: 45.4%; EPSS 45.4% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

fortinet fortios 6.0.10, 6.2.4

Is CVE-2020-12812 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2020-07-24 Published
2021-11-03 Added to CISA KEV
2022-05-03 CISA patch deadline
2026-08-12 CISA SSVC: exploitation active

Known exploited

Added: 5y ago (2021-11-03)
Patch by: 2022-05-03 (4y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: Fortinet, FortiOS
CISA name: Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

Hive ransomware gang
PLAY ransomware gang

reported by cisa.gov cisa.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1556 Modify Authentication Process exploitation
T1556 Modify Authentication Process primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 2mo ago (2026-08-12)

Exploit prediction

45.38% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a Fortinet FortiOS

Classification

Weakness

CWE-287 Improper Authentication
CWE-178 Improper Handling of Case Sensitivity

Technology feeds

Fortinet rss critical rss

References

fortiguard.com /psirt/FG-IR-19-283
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-12812
government-resource, us-government-resource

Sources

CVE List CVE-2020-12812
NVD CVE-2020-12812

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.