Q. I'm creating a Nano Server image. How do I add that latest CU when building it?

A. To include the latest CU in a new Nano Server image during creation (remember another option is to bake the update into the source WIM file which is a better option long term as documented at http://windowsitpro.com/windows-server-2016/patch-nano-server-wim-file) the -ServicingPackagePath parameter is used while passing the cab file (to extract CAB from MSU see http://windowsitpro.com/windows/how-can-i-extract-cab-file-msu-file). For example:

New-NanoServerImage -MediaPath 'S:\OS Images\Windows Server 2016 RTM\Expanded' `
-ServicingPackagePath 'D:\NanoBuild\Updates\Windows10.0-KB4010672-x64.cab' `
-BasePath .\Base -TargetPath $NanoVHDPath -ComputerName NanoVM2 `
-DeploymentType Guest -Edition Standard `
-Storage -Defender -EnableRemoteManagementPort `
-Package Microsoft-NanoServer-DSC-Package `
-UnattendPath .\unattend.xml `
-AdministratorPassword $adminPass -DomainName savilltech -ReuseDomainNode