Prove or reject unauthenticated remote OS command execution as the PaperCut service account on stock PaperCut NG/MF 25.0.11 via a pre-auth Release Station / MFD card-ID flow reaching the external card-lookup runtime, then replay identically on stock 25.0.12 to confirm the fix blocks the chain. This maps to the PaperCut NG/MF URGENT Security Bulletin of 27 Aug 2026 active exploitation, all versions affected . Whether a stock remote mechanism exists is an open question; card-ID SQL injection and JDBC URL injection are unproven hypotheses only.