The customer will be able to download the Hotfix from the TIBCO Support Customer Portal Web UI using their username and password for the TIBCO Support Web page.Once logged on they can find the Hotfix under the Download Menu :

AvailableDownloads/Administrator/5.9.1/hotfix-02

OR 

The customer will be able to download the Hotfix by using direct link to Administrator/5.9.1/hotfix-02
https://support.tibco.com/s/hotfixes?id=a011a000009RwpwAAC
 

OR

Refer to  Article 000022290 : How can TIBCO customers download / access all GA hotfixes
Link to Article  000022290 :https://support.tibco.com/s/article/hotfix

Please contact TIBCO Support if you have any problems finding or downloading this hotfix.
Listed below is a summary of updates included. Refer to the associated readme document for any additional information.

================================================================================
Closed Issues in 5.9.1_HF-002 (This release)

ADM-5658 
TIBCO Administrator now prevents persistent cross-site scripting in 
TIBCO Administrator Tomcat. A persistent cross-site scripting attack is used 
on a web application to send malicious code, generally in the form of a 
browser-side script. The malicious script is permanently stored on the target 
web application's database, log files, and so on. When the users access the 
web application, the stored script is executed and user's sensitive information 
is compromised.

================================================================================

TIBCO Administrator 5.9.1 Hotfix 02 is now available.

Product: TIBCO Administrator Version:5.9.1 OS: All

Install TIBCO Administrator 5.9.1 Hotfix-02 , The customer will be able to download the Hotfix by using direct link to Administrator/5.9.1/hotfix-02

https://support.tibco.com/s/hotfixes?id=a011a00000Dgp4XAAR