Fortinet has repeatedly warned that CVE-2020-12812, a five (5) year old improper authentication flaw in FortiGate SSL VPN, is still being actively exploited in the wild, allowing attackers to bypass two-factor authentication (2FA) under specific configurations. The vulnerability stems from inconsistent username case-sensitivity handling between FortiGate, which is case-sensitive by default, and LDAP directories, which are not, enabling attackers to authenticate without FortiToken by submitting a valid username with altered casing. Exploitation is possible when local FortiGate users have 2FA enabled but authenticate via LDAP, belong to LDAP groups configured on the firewall, and those groups are used in authentication policies for administrative or VPN access, particularly when a misconfigured secondary LDAP group allows authentication fallback. Fortinet states the flaw has been abused by ransomware operators and state-sponsored threat actors for years, was weaponized in widespread perimeter-device attacks in 2021 and was added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S Cybersecurity and Infrastructure Security Agency (CISA) following joint warnings with the FBI. Although the issue was addressed in July 2020 with FortiOS versions 6.0.10, 6.2.4, and 6.4.1, recent advisories confirm continued abuse against unpatched or misconfigured systems. CTIX analysts urge any affected administrators to follow Fortinet’s guidance to upgrade affected devices, disable username case sensitivity, remove unnecessary secondary LDAP groups, and treat any evidence of 2FA bypass as a full compromise requiring immediate credential resets.