A Python proof-of-concept for CVE-2026-35616 is now public on GitHub. It forges the reverse-proxy headers X-SSL-CLIENT-VERIFY: SUCCESS and X-SSL-CLIENT-CERT to reach certificate-protected FortiClient EMS API endpoints without logging in. Fortinet's FG-IR-26-099 (Apr 4) marks the bug as exploited in the wild (CVSS 9.8, critical). Only EMS 7.4.5 and 7.4.6 are affected; 7.2 and 8.0 are not. The fix is the 7.4.5.2111 / 7.4.6.2170 hotfix or 7.4.7 and later. With a working public exploit, any 7.4.5 or 7.4.6 server still unpatched and reachable on its HTTPS port is likely to get hit by mass scanning. Another option is to have the proxy strip those two headers from client requests.