As a network administrator, you receive a report from your vulnerability scanner that a certain service is running on an open port which shouldn't be. What immediate action should be considered?

Disabling the service is the immediate action to consider when an unauthorized service is running on an open port. This will prevent potential exploitation while the situation is further assessed. Running a malware scan is important, but the immediate threat is mitigated by stopping the service.