As I received this question a couple of times in the past here a short summary of the different update types used with SharePoint:
What is it: A service pack is a combination of previously released fixes, fixes which have only been released in context of the service pack and potentially new functionality added to the product.
What is included: new fixes, new functionality, all previously released fixes (older Service Packs, CUs, PUs)
Multilingual: No. You need separate Service Packs for each installed language
What is the prerequesit: Usually there is no prerequesit to install a service pack.
When to install: it is recommended to evaluate and install Service Packs as soon as possible.
Impact on future fixes: CUs and PUs released more than 12 months after the last service pack can only be installed if the Service Pack has been installed before
Installation Sequence: no specific sequence. You can install a service pack on top of CUs and PUs released later.
Release Cycle: no specific release cycle
Cumulative Update (CU)
What is it: A cumulative update includes fixes for problems with our product that have been reported by customer in context of support cases.
What is included: new and all previously released fixes (CUs and PUs) since the oldest supported service pack (within the first 12 month after a Service Pack has been released the CU includes also fixes released after the previous service pack)
Multilingual: Yes. The CU package includes fixes for all languages.
What is the prerequesit: The oldest supported service pack. Within the first 12 months after releasing a SP you can install on the latest SP and the previous one. CUs released more than 12 months after the newest SP require the newest SP to be installed.
When to install: CUs should only be installed to resolve specific issues fixed with the CUs as mentioned in each CU KB article: "Apply this hotfix only to systems that are experiencing the problems described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.". Or if adviced to install by Microsoft Support.
Impact on future fixes: In general a CU is not a prerequesit of future CUs and PUs. But in some situations a CU can be a prerequesit of a COD (see below).
Installation Sequence: no specific sequence.
Release Cycle: every second month (February, April, June, August, October, December) - since June 2014 CUs are released every month.
Public Update (PU)
What is it: A public update usually includes security fixes for the product or fixes for problems which affect a broad number of customers.
What is included: please review the KB article for each public update in detail to see which fixes are included.
Multilingual: Yes. The PU package includes fixes for all languages.
What is the prerequesit: Usually the oldest supported service pack. Within the first 12 months after releasing a SP you can install on the latest SP and the previous one. PUs released more than 12 months after the newest SP usually require the newest SP to be installed.
When to install: As a PU includes security fixes it is recommended to evaluate and install PUs as soon as possible.
Impact on future fixes: In some situations a PU can be a prerequesit of future CUs and PUs. E.g. the March 2013 PU for SharePoint 2013 will be a prerequesit for all future CUs (and potentially PUs) for SharePoint 2013.
Installation Sequence: A PU can only be installed on a system which does not already have the included fixes applied through another source - e.g. through an earlier released CU. As PUs are advised to be installed by all customers while CUs should only be installed by customers affected by one of the fixes incuded in the CU the test cycle for a PU is much longer than for a CU. That means a PU released in March can be superseeded by a CU released earlier (e.g. February CU or December CU). Also in some situations a CU requires an earlier released PU to be installed first - otherwise the fix will not install.
Release Cycle: once a month (if required)
Critical On Demand Fix (COD)
What is it: A COD is a fix which is provided only to a small number of customers affected by a critical problem directly through Microsoft Support to provide a quick relief. The code change in the COD will be included in one of the next CUs and it is advised to install that CU on top of the COD as soon as it has been released.
What is included: only the specific fix for a specific issue.
Multilingual: Usually not.
What is the prerequesit: Usually the CU that was used as the baseline to develop the COD. Microsoft Support will provide guidance which CU is required to be installed as a prerequesit for the COD.
When to install: Only if advised by Microsoft Support.
Impact on future fixes: A COD will not have an impact on future CUs or PUs. But the next CU can potentially revert the the code change introduced in the COD. See Installation Sequence.
Installation Sequence: As the COD will be released as soon as possible to a small number of affected customers. It might happen, that the next CU released shortly before or after the COD will not include the code change introduced by the COD. Customers which need the fix in the COD have to wait for the CU which will include the fix included in the COD. Microsoft Support will provided guidance on which CU can be installed on top of a COD.
Release Cycle: on demand
Excellent article, Very well writtenb and highly commendable.
it's very helpful! Thank you!
Thanks Stefan! Plan to pass on to User Groups, ISV's and customers.
Hi Stefan - Just to be clear, this applies to SP 2013 and 2010, correct?
Also, are MS monthly security notifications considered a PU, things like the SP 2010 bulletin that just came out (MS13-024)?
That is correct.
Great Stuff! Thanks
Perfect and Nice Explanation !! Thanks a lot !!
Good reference material - thanks Stefan!
Very helpful. thanks.
thanks for sharing.
There is one thing i want to ask...could we apply the service pack or cu on SharePoint 2007 which is already expired?
sorry I don't understand the question.
What do you mean by an expired SharePoint 2007?
Tank you for this information !
The Feb 15 CU being pushed out via WSUS brought me here. Great info, BUT this statement regarding CUs is one of the reasons new SP admins have so much trouble wrapping their heads around this patching paradigm; "What is included: new and all previously
released fixes (CUs and PUs) since the oldest supported service pack (within the first 12 month after a Service Pack has been released the CU includes also fixes released after the previous service pack)"
This is NOT entirely true, and in fact is completely misleading based on your explanation in your Aug 2014 Blog "SharePoint patching demystified" where you explain that a CU only contains the previous released fixes FOR THOSE COMPONENTS that have a fix in this
current CU. For instance the Feb 14 CU includes a fix for Word Automation Services so it includes all previous CU fixes for WAS but if a previous CU also included a fix for other SharePoint services those are not included in the Feb 15 CU.
Personally I think MS is doing us a disservice labeling these as SharePoint CUs when it would be much clearer to receive a patch for SharePoint Word Automation Services. Just my $.02 worth.
the article was referring to the Uber package which I document in each CU and which we release with each CU (with two exceptions so far).