The question isn’t can you but should you.
What’s a CU? Starting with Exchange Server 2013, the Exchange Product Group (PG) went to a quarterly updating process titled Cumulative Updates. These CU’s literally uninstall and reinstall Exchange when they are applied to a server. This is one reason a CU install process can take several hours.
You’ll want to be aware that the PG only supports N (the current released CU) and N-1 (the previous released CU) CU’s when customers are in an Exchange hybrid configuration. They have taken this a step further and presume that all customers are staying up to date with the current cadence of updating the on premises servers every 92 days, even if you are not in a hybrid configuration. To that end, the PG only makes N and N-1 CU’s available for public download. Consequently, if you don’t stay current with updates, you’ll not be able get the missing CU’s.
The good news is, you can skip CU’s. Since each CU is a complete uninstall/re-install, it is possible to not install each CU to stay current. Example, if you want to install a brand-new Exchange server, you only need the current or most recent CU. Nonetheless, the PG does NOT test skipping CU’s. Therefore, it is potentially a bad idea to skip them as there are unknown and untested issues that could arise.
From Microsoft’s page: https://technet.microsoft.com/library/ff728623(v=exchg.150).aspx the following exert:
“When upgrading Exchange from an unsupported CU to the current CU and no intermediate CUs are available, you should upgrade to the latest version of .NET that's supported by Exchange first and then immediately upgrade to the current CU. This method doesn't replace the need to keep your Exchange servers up to date and on the latest, supported, CU. Microsoft makes no claim that an upgrade failure will not occur using this method, which may result in the need to contact Microsoft Support Services.”
Now you’re thinking, what if I do need a missing CU to download? One situation would be if you need to restore and run setup /m:recoverserver on a server that is older than N-2 CU. For example, if an Exchange 2013 CU15 DB needs to be mounted onto an Exchange CU19 server. Customers have performed this task without issue. However, it just isn’t possible to test all the possible combinations of skipping CU versions, and to do so could yield some surprising results.
So, there you go, you can skip CU’s, but it’s at your own risk.
Mike