Watford took the lead with a tenth-minute Tommy Smith penalty only for Jay Bothroyd to equalise four minutes later, but the home crowd were on their feet as McCormack slammed home the spot-kick with virtually the last kick of the match.
The Bluebirds made two changes from the side that drew against Bristol City with Chris Burke and McCormack replacing Peter Whittingham and Michael Chopra who were on the bench.
The match started off at a smart pace with both sides breaking quickly with Paul Parry setting up a City attack while Smith broke away for the visitors.
Yet another break, this time from former Cardiff player Jobi McAnuff, led to Watford taking the lead. He outpaced Stephen McPhail who brought him down inside the area for leading scorer Smith to stroke home the spot-kick.
In the 14th minute City levelled when a Burke cross fell to Bothroyd and he hammered home from close range for his tenth goal of the season.
A superb tackle from Roger Johnson prevented Tamas Priskin from closing in on goal as the game swung from end to end.
Priskin then beat Hungarian team-mate Gabor Gyepes but Kevin McNaughton cleared for an unproductive corner.
Five minutes before the break City skipper Joe Ledley surged into the six-yard box but, instead of shooting, he passed out wide to Burke and by then the chance was lost.
McCormack headed a glorious chance wide from a Tony Capaldi cross in the 50th minute and midway through the half Bothroyd met a centre from Ledley but his header drifted wide of the post.
Chopra replaced Burke in the 74th minute but it was not until time added on that City scored the winner. Ross Jenkins handled a Roger Johnson header on the line and McCormack slammed the spot-kick into the corner of the net.
It was so late that Watford only had time to kick-off before referee Andy Hall blew for full-time.