---
id: 8951
title: "CargoWise WebTracker – The Keys Were in the Cargo"
source_domain: slcyber.io
source_url: "https://www.slcyber.io/research/cargowise-webtracker-the-keys-were-in-the-cargo"
published_at: "2026-06-25T00:00:00Z"
tags: ["rce", "vulnerability-research"]
phying_url: "https://phying.com/item/8951"
lang: en
---

# CargoWise WebTracker – The Keys Were in the Cargo

## Summary

Searchlight Cyber researchers discover hardcoded symmetric keys in CargoWise WebTracker enabling authentication bypass, org enumeration, document download, XSS, open redirect, SSRF/NTLM hash leakage, and pre-auth RCE via ViewState deserialization.

## Intelligence Metadata

- **Sources:** slcyber.io
- **Published:** 2026-06-25T00:00:00Z
- **Original:** https://www.slcyber.io/research/cargowise-webtracker-the-keys-were-in-the-cargo
- **Phying News:** https://phying.com/item/8951