An unauthenticated remote code execution vulnerability is usually considered a critical finding because it allows an attacker to gain control over the system without needing credentials, leading to potentially severe impacts on confidentiality, integrity, and availability. Since sensitive customer data is at stake, the severity and potential business impact are high, necessitating immediate attention and remediation efforts. That's why it's classified as critical and should be communicated to the client as such.