When to close CVE's