CVE-2020-27868: Qognify Ocularis EventCoordinator deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable deserialization leading to SYSTEM code execution, with a CVSS of 9.8 and very high EPSS, makes this an urgent patch target.

What it is

Qognify Ocularis 5.9.0.395 fails to validate serialized objects sent to the EventCoordinator endpoint, allowing deserialization of untrusted data. Because the endpoint is reachable without authentication, an unauthenticated remote attacker can trigger code execution. The flaw is a classic untrusted deserialization issue in a network-facing service.

Impact

An attacker gains arbitrary code execution in the context of SYSTEM on the affected installation. That yields full control of the host, including access to video management data and any connected systems.

Attack surface

Reached over the network via the EventCoordinator endpoint; the CVSS vector shows AV:N/PR:N/UI:N, so no authentication and no user interaction are required. Any host that can reach the endpoint can attempt exploitation.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.81753, 99.6th percentile), indicating strong likelihood of exploitation activity. References are vendor release notes and a ZDI advisory; no public exploit code is confirmed in the record.

What to do

• Apply the vendor update from Qognify's software downloads page; this is the only definitive fix.
• Restrict network access to the EventCoordinator endpoint to trusted management networks or VPN only.
• Segment Ocularis servers from general user and internet-facing networks to limit reachable attack paths.
• Monitor for and block unexpected serialized payloads or anomalous POST traffic to EventCoordinator.
• If patching is delayed, consider taking the endpoint offline or placing it behind an authenticating reverse proxy.

Detection

• Alert on POST requests to the EventCoordinator endpoint from unexpected source IPs or with unusually large or binary bodies.
• Monitor for child processes spawned by the Ocularis service (e.g., cmd.exe, powershell.exe, wscript.exe) as a sign of post-exploitation.
• Watch for outbound connections from Ocularis hosts to unfamiliar external addresses, which may indicate payload retrieval or C2.
• Review Ocularis and Windows event logs for service crashes or restarts around suspicious endpoint traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.