Why should I apply a CU for SP2 that was released after the release of SP3?

Question

Checking SQL Server 2014 build versions to identify the right update for my server I got a little confused as what update to use. Did some research and found out I should Apply the latest Service Pack and Cumulative Update. Ok, but one question remained:

I currently have SP2 installed and there's a CU for SP2 with the release date of July 29, 2019, but SP3 has been released October 30, 2018.

The way I see it, the CU15-CU18 for SP2 shouldn't exist. (I know I'm wrong, but I don't know why)
What's there in a service pack that one might not want to install it but will install other CUs that were released after the most recent SP?

Answer 1

If you plan to remain on SP2 for now, then you can install any SP2 CUs that you determine are needed. To specifically answer why you should install an SP2 CU at this point, that is somewhat of a murky answer. You don't really need to install a CU unless it has a fix you need, so if you don't have any issues that the CUs fix, then you might consider just not installing them.

If you upgrade to SP3, then you can start installing SP3 CUs.

As to why the SP2 CUs in question even exist, Microsoft continues to release CUs and security updates for older service pack levels for some time so that you are not forced to update to the latest SP immediately in order to be able to install the fixes they addresses.

CUs generally have fixes for issues that affect a limited number or customers, so it's not critical to upgrade every time a CU is released. You certainly don't want to upgrade production systems as soon as a CU is released unless there is something in it that addresses an issue on your system.

More importantly, though, are the security updates, and it is advisable to get those installed and tested in non-production environments and then to production sooner rather than later. If there is a data breach, you want to be able to say that all security updates are installed, even if the breach was unrelated to those updates.

You can check how long a given service pack will be supported/updated at Search Product Lifecycle, where you'll see the following:

• SQL Server 2014 Service Pack 1 has a support end date of 10/10/2017 (i.e., you should not be running SP1 as you've missed all security updates since 10/10/2017)
• SQL Server 2014 Service Pack 2 has a support end date of 1/14/2020 (i.e., you need to plan to upgrade to SP3 soon because security updates for SP2 will not be released after 1/14/2020).
• SQL Server 2014 Service Pack 3 has no support end date published.