This hotfix can be downloaded from the SFDC Customer Portal Web User Interface using your username and password for the TIBCO Support Web.
Once logged on you can find the hotfix under the Downloads Menu: "AvailableDownloads/ActiveFulfillment/4.0.2/Hotfix-1"
TIB_af_4.0.2_HF-001.zip file includes the Readme file inside. Please unzip this file and look for the Readme file for Instruction on how to apply the hotfix. 
================================================================================
Closed Issues in 4.0.2_HF-001 

AF-8656
Instead of the original ID that was sent, an auto-generated ID was returned in OMS callback notification.

AF-8653
OPE did not return any error response when one of the promotion ID was invalid.

AF-8647
OPE sent a query to the database when product was not found in the memory.

AF-8646
Some methods missing from the OPE custom/extended evaluation.

AF-8628
SubmitOrder failed when "Enable User Name token based Security" was set to false.

AF-8615
Primary keys were missing in a few tables.

AF-8603
A null pointer exception occurred when the following flag reached the set threshold value:
com.tibco.fom.orch.generator.splitStateMachineThreshold and com.tibco.fom.orch.maxNoMilestonesLoadedinMemory

AF-8586
Encountered Soap Fault while trying to hit GetOrderExecutionPlan with UDF value as xml.

AF-8579
Execute request or response were not processed for plan items in case of frequent or simultaneous calling.

AF-8528
When http://hostname:port/Login/Login.jsp was replaced with http://hostname:port/com an empty file was downloaded.

AF-8519
Same product model with different product IDs was created, hence high memory consumption due to processing of duplicate models.

AF-8518
Plan item could not be moved from execution to error in the user interface.

AF-8497
X-Frame-Options header was not included in the HTTP response to protect against clickjacking attacks.

AF-8496
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to "nosniff".

AF-8495
CORRELATIONID sent while loading model is mapped back in model loading notification.

AF-8494
From OMSUI you could force complete a planitem that was still running.

AF-8493
The count of orders in Execution state and Feasibility state displayed in the order summary dashboard did not match with actual number of orders.

AF-8491
Cookies were not set with secure and httponly flags.

AF-8490
Background image on login window and the header image could not be changed post login on the OMSUI.

AF-8476
HTTP PUT and DELETE methods were not allowed.

AF-8464
Subscriber ID was not displayed on the Order page of the OMSUI.

AF-8223
In grid view, you could not hide or display the Non-Execution plan item when needed.