I would recommend to be in touch with your CSP Partner or reseller to perform this action.
Deploying a Cumulative Update requires partner expertise since it needs to cope with platform and application side deployment.
In your case, partner that implemented this solution should review the process and decide how to perform the action.
From a standpoint perspective moving from CU 2 to CU 3 might not give the added value to move from a higher (latest) build.
Currently we are in the process of releasing officially CU 30.
The best suggestion here is to deploy the latest and greatest CU to make your environment more robust and enhanced.
This should be done under the surveillance of your partner and handled as a business task.