A cumulative update is a Windows servicing package that contains all previously released security and quality fixes for a given Windows version, together with the new fixes of the current month, so that installing the latest one brings a device fully up to date. In the context of Windows updates & recovery it is the standard monthly update, often called the latest cumulative update (LCU), delivered through Windows Update, WSUS and other management tools.
The cumulative model replaced the older practice of shipping many separate patches that had to be installed in the right order. With cumulative updates, a device that missed several months needs only the newest package, and every patched device on the same build runs the same, tested combination of fixes.
How cumulative updates work in Windows
Each Windows version, such as a specific Windows 11 release, receives a cumulative update every month. The package raises the build revision number, for example from one revision of a build to a higher one, and replaces older versions of system files with the newest ones. Installing it supersedes every earlier cumulative update for that version.
Since 2021, Microsoft has combined the servicing stack update (SSU), which updates the component that installs updates, with the cumulative update into a single package. This removes a common source of failure in which the SSU had to be installed separately before the LCU would apply.
To keep downloads manageable, Windows Update does not transfer the full package to every device. It uses differential downloads that send only the changes needed for the device’s current state. Windows 11 version 24H2 also introduced checkpoint cumulative updates, in which later updates contain only changes since the most recent checkpoint, reducing download size and installation time.
| Release | Typical timing | Content | Installation |
|---|---|---|---|
| Security update (B release) | Second Tuesday of the month | Security and quality fixes | Required, installed automatically |
| Optional preview (D release) | Fourth week of the month | Non-security fixes and new features | Optional, user or admin initiated |
| Out-of-band update | Any time, when urgent | Fix for a critical issue or exploit | Released outside the normal schedule |
The security release is published on Patch Tuesday. Fixes from the optional preview are rolled into the next month’s security release, so organizations that skip previews still receive them about two weeks later.
Cumulative update compared with other update types
Windows uses several update types with different scope and frequency. Confusing them leads to wrong expectations about download size, restart behavior and how long a version stays supported.
| Update type | Frequency | What it changes | Restart |
|---|---|---|---|
| Cumulative update | Monthly | Fixes for the current version | Usually required |
| Feature update | Annually | New Windows version and support period | Required, longer installation |
| Enablement package | With some feature updates | Activates features already shipped dormant | One quick restart |
| Hotpatch update | Most months on eligible systems | Security fixes applied in memory | Not required until a baseline month |
| Driver and firmware updates | As published by vendors | Hardware-specific components | Depends on the component |
A cumulative update never moves a device to a new Windows version; that is the job of a feature update. Conversely, a feature update does not remove the need for monthly cumulative updates, because each version has its own servicing stream until its end of servicing date.
Deploying cumulative updates in organizations
Organizations rarely install cumulative updates on every device on day one. They use deployment rings, small groups that receive updates first, so problems surface before the update reaches business-critical machines.
| Ring | Devices | Typical delay after release | Purpose |
|---|---|---|---|
| Test ring | IT lab and test machines | Same day | Catch obvious failures |
| Pilot ring | Volunteers across departments | A few days | Validate business applications |
| Broad ring | Most devices | About one to two weeks | Main rollout |
| Critical ring | Sensitive or specialized systems | Two weeks or more | Minimize risk to key operations |
Tools such as Windows Update for Business, WSUS and device management platforms set these delays through deferral periods and deadlines. The trade-off is constant: longer deferrals reduce the risk of regressions but lengthen exposure to vulnerabilities that the update fixes.
Problems, rollback and recovery
Because a cumulative update replaces many system files at once, a single faulty fix can affect many devices. Microsoft can disable a problematic non-security change remotely through Known Issue Rollback, which avoids uninstalling the whole update.
- Installation fails or rolls back: often caused by low disk space, corrupted component store or third-party security software; running DISM and SFC repairs usually helps.
- Uninstalling the update: possible from update history in Settings, but the combined servicing stack portion cannot be removed.
- Boot failure after an update: the Windows Recovery Environment offers an option to uninstall the latest quality update.
- Pausing updates: delays installation temporarily but does not skip fixes, because the next package still contains them.
Uninstalling a cumulative update removes all security fixes of that month, so it should be a temporary measure while a corrected update or a workaround becomes available.
Before installing, a short readiness check prevents most failures: confirm several gigabytes of free space on the system drive, make sure a recent backup or restore point exists, and suspend disk encryption only when the release notes require it. These steps take minutes and turn an update problem into a recoverable event instead of an outage.
Put simply
A cumulative update is the monthly repair bundle for Windows. Instead of handing you dozens of separate fixes, Windows gives you one package that already contains every earlier fix plus the new ones.
It is like a corrected edition of a book that includes every earlier correction. You only need the newest edition, even if you never received the previous ones. That is why a computer that was switched off for months can catch up with a single update.
In practice
A company with 800 Windows 11 laptops receives the monthly security release on Patch Tuesday. The IT team lets 20 test machines install it the same day and 60 pilot users the following day. Over three days, the pilot group reports that one older accounting add-in crashes on startup.
The team pauses the broad ring and checks the known issues for the release. A Known Issue Rollback is announced within days, and the add-in vendor publishes a compatible version. The broad ring then receives the update with a five-day deadline.
A laptop that had been in storage for four months is switched on during the rollout. It downloads only the newest cumulative update and becomes fully patched after one restart, showing that the cumulative model removes the need to install missed months one by one.