During a penetration test, you discover an unauthenticated remote code execution vulnerability in a client's primary web application. This application contains sensitive customer data. How should this finding be classified in terms of severity when promptly communicating it to the client?
Critical
High
Medium
Low