Go straight to CU23:
Run each step separately first to prep the AD Forest:
Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareSchema
Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAD
Setup.exe /IAcceptExchangeServerLicenseTerms /PrepareAllDomains
Then install .net 4.8 on the server
then install CU23 FROM AN ELEVATED PROMPT
then install the security patch FROM AN ELEVATED PROMPT:
https://www.microsoft.com/en-us/download/details.aspx?id=102775