During testing, a critical vulnerability is discovered on a client's core server. Which of the following should be the NEXT action?

Disabling network ports or services on client infrastructure without explicit prior authorization exceeds the agreed scope of the penetration test and constitutes unauthorized modification of production systems.

Completing all findings before reporting delays the client's awareness of a critical risk that may require immediate emergency remediation, violating responsible disclosure expectations built into most engagement contracts.

Standard penetration testing ethics and rules of engagement require that critical vulnerabilities be reported to the client immediately upon discovery, because the finding represents an active and severe threat to the target environment. Waiting until all testing is complete could allow the vulnerability to be exploited by a real threat actor during the remaining engagement window. Promptly alerting the client with technical details enables them to make an informed decision about emergency remediation or risk acceptance.

Taking a target system offline without client authorization disrupts business operations and falls outside the tester's approved scope, regardless of the severity of the vulnerability found.