Elements EPP (Windows) Software Updater fails to install 7-Zip updates with WA_VMOD_ERROR_CANNOT_VERIFY

Davidb

Hello,

We are using WithSecure Elements Endpoint Protection (Windows) with Software Updater enabled on a large Windows workstation fleet. Updates for most third-party applications install correctly, but 7-Zip consistently fails to update.

Issue

• Application: 7-Zip (vendor: Igor Pavlov)
• Result: Update installation fails
• Error shown in the Software Updater UI: WA_VMOD_ERROR_CANNOT_VERIFY
• We see repeated failures on multiple endpoints.

Profile/Policy context

• Software Updater is enabled in the workstation profile.
• The setting “Install only signed updates” is NOT enforced in our profiles.

Could you confirm what WA_VMOD_ERROR_CANNOT_VERIFY means specifically for 7-Zip in Elements Software Updater, and what the recommended remediation is?
We need guidance on whether this is expected behavior (e.g., package signature/verification limitations for 7-Zip), or if there is a supported fix/workaround (policy setting, certificate/trust chain requirement, additional endpoints/domains to allow, etc.).

Thank you.

Sethu Laks

Hi @Davidb

This is a common situation with 7-Zip updates in WithSecure Elements Software Updater. Here’s what’s going on:

• Why does this happen?
  7-Zip’s installer is usually unsigned or not consistently signed by the vendor. The Software Updater checks for digital signatures to make sure updates are safe. If it can’t verify the signature, it blocks the update and shows the WA_VMOD_ERROR_CANNOT_VERIFY error.
• Is this expected?
  Yes, this is expected behavior for unsigned updates. Even if you don’t enforce the “Install only signed updates” setting, the updater may still block unsigned installers for security reasons.
• What can you do?
  1. The safest option is to manually install 7-Zip on affected computers.
  2. If you want to allow automatic installation of unsigned updates, you can change your Elements profile settings to permit this (Software Updater > Installation > Enable Install only signed updates). However, be aware this reduces your security, as unsigned updates could be tampered with.
  3. There’s no way to fix this with certificates or trust settings, since the issue is with how 7-Zip is distributed.

In summary:
This is a limitation of the 7-Zip installer itself. Unless the vendor starts signing their updates, this error will continue for automatic updates. Manual installation or accepting the risk of unsigned updates are the only workarounds.

If you need help changing your profile settings or have more questions, feel free to ask!