CVE-2020-12812CISA KEVEPSS p98.8%

CVE-2020-12812Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Fortinet / FortiOS

Description

Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.

Scoring

CVSS 9.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS45.38% probability of exploitation · percentile 98.8% · 2026-10-03T12:00:21Z
Last modified2026-10-02

CISA KEV entry

Added to KEV: 2021-11-03

(incoming)1

TypeTargetConfidenceTier
KEVEntryFortinet FortiOS SSL VPN Improper Authentication Vulnerabilitykev-cve-2020-128120%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
Fortinet FortiOS and FortiProxy Improper Authorization
CVE
Fortinet Multiple Products Authentication Bypass Vulnerability
CVE
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
CVE
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVE
CVE-2026-44277
CVE
CVE-2025-24471
Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.