This hotfix can be downloaded from the SFDC Customer Portal Web User Interface using your username and password for the TIBCO Support Web.
Once logged on you can find the hotfix under the Downloads Menu: "AvailableDownloads/ActiveFulfillment/4.0.1/Hotfix-2"
TIB_af_4.0.1_HF-002.zip file includes the Readme file inside. Please unzip this file and look for the Readme file for Instruction on how to apply the hotfix. 
================================================================================

Closed Issues in 4.0.1_HF-002 

AF-8548
Encountered Soap Fault while trying to hit GetOrderExecutionPlan with UDF value as xml.

AF-8516    
When http://hostname:port/Login/Login.jsp was replaced with http://hostname:port/com an empty file would be downloaded.

AF-8502
Same product model with different product IDs was created, hence memory consumption due to
processing of duplicate models.

AF-8438    
CORRELATIONID sent while loading model will be mapped back in model loading notification.

AF-8436    
The count of orders in Execution state and Feasibility state displayed in the order summary 
dashboard did not match with actual number of orders.

AF-8435    
From OMSUI a user could force complete a planitem that is still running.AF-8423    
The Internal Error Handler- "OrderID not found in getStatemachine" error seen on 
completing planitem in Error from OMSUI after OMS Server restart.

AF-8415    
An order containing planitem in an error is sent to a member in cluster. If that member 
went down, the order would remain in the execution state when it was retried from OMSUI.

AF-8410    
OMSUI did not start and the 
java.lang.NoSuchMethodError:com.google.common.collect.ImmutableSet exception 
seen on startup.

AF-8400    
HTTP PUT and DELETE methods not allowed.

AF-8399    
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to "nosniff".

AF-8398    
Cookies were not set with secure and httponly flags.

AF-8397    
X-Frame-Options header is not included in the HTTP response to protect 
against 'ClickJacking' attacks.

AF-8361    
When retrying plan item via OMS UI(InternalErrorhandler), Orchestrator sent 
a new planItemexecute request. But, the plan item remained in execution status 
after orchestrator received a PlanItemExecuteReply with success element set 
to FALSE.

AF-8360    
While tryig to retry a failed PlanItem, process component was not getting triggered as
PlantItemExecuteRequest was not generated.

AF-8283
An NullPointerException occurred when the com.tibco.fom.orch.generator.splitStateMachineThreshold and
com.tibco.fom.orch.maxNoMilestonesLoadedinMemory flags reached the set threshold values.

AF-8268    
Background image on login window and the header image could not be changed
post login on OMSUI.