Recently, I needed to test an older CU and couldn't find it. At least not easily. Previously I had just searched for the update and usually quickly found it, but some of the changes on the Microsoft sites have made this harder. This is a short article that might help you feel less frustrated with the process.

The Initial Search

As I have many times, I've often just run a search to find a CU. While I do maintain a build list, it's a search to often find the item I need, so it's easier to type something in a browser. In this case, I searched "SQL Server 2016 SP2 CU8. As I expected, I quickly get a KB article.

When I clicked on this, I started to have issues. If you scroll slightly down the page, you'll see that the  below the first text, in the second section, is the "How to obtain this cumulative update" (emphasis mine). There is a link here.

If you click this, however, you'll get the latest update. That is CU10. In fact, when I click the update, I see this:

There is nowhere to actually find previous updates. The KB articles are listed on the left, but if I click the one for CU8, I go back in a circle to the kb page with a download link that takes me back to CU10.

I do understand that Microsoft would like us to just use the latest update. I agree with that, and I wish more people would ensure they are patched. I also wish more vendors would try to be up to date and certify all CUs against their software. I know this takes resources, but applying patches is important for security, if no other reason, and vendors ought to have to comply.

Microsoft is moving towards getting SQL Server to be evergreen, meaning it's always patched, but that's not helpful. Especially in this case, when trying to actually verify there isn't an issue with this particular CU. I need that package, not the latest.

Finding the Correct Package

If you go back to the KB article, and look in the same section, there's a link to the Windows Update Catalog. In the image below, my cursor is near it.

If I click this, I go to the Catalog, and again, I see the latest updates. However, I see them for most, if not all, SQL Server products I'd want to patch.

This isn't helpful, but in the upper right is a search box. Let's enter some text in there.

I could have tried to guess what text to enter, but this works well. When I search, I see all the patches.

There's a download link for all of these on the right, and I could quickly find CU8 near the top and download it.

Conclusion

While I like the Update Catalog, I do think that it is a little deceiving to only have a link to the latest CU patch. This is subtle psychology that might get some people to think that they should just apply the latest version, but it also invites mistakes. If I'm potentially in a hurry and click download, I might assume that KB article linked me to the right CU. Then I could apply a CU that might get me into trouble.

I agree with the idea of using the latest patches, but disagree with the implementation. However, this article should help you remember how to quickly find the patch you need if it's not the latest one.