Hypothetical Situation: I am conducting a penetration test for a client. A scope of engagement has been defined of what I can and cannot do. While performing a vulnerability scan I come across a known vulnerability that is outside my scope. How do I go about professionally handling this?
Legally, I cannot perform any more assessments as I would be intentionally working outside of the scope. However, haven't I technically already stepped outside my scope? If I was to report on this, without performing any other penetration testing, could I run into any legal ramifications?
If I am in the clear legally, how would one properly deal with this? Is it better to report it to my client as a regular use who found a vulnerability would or would it be better to include this is a report?
If I am in the threat of legally being in trouble, what is the proper way of dealing with this to protect myself?