The same security fix provided to WordPress has also been added to WordPress MU. Version 2.6.5 takes care of the XSS security risk and is issued as an immediate upgrade because it fixes these holes.
The files changed in the latest update are as follows:

tags/2.6.5/wp-signup.php

tags/2.6.5/wp-login.php

tags/2.6.5/wp-includes/post.php

tags/2.6.5/wp-includes/version.php

tags/2.6.5/wp-includes/wpmu-functions.php

tags/2.6.5/wp-includes/feed.php

tags/2.6.5/wp-includes/widgets.php

tags/2.6.5/wp-includes/rss.php

tags/2.6.5/xmlrpc.php

tags/2.6.5/wp-settings.php

tags/2.6.5/wp-admin/users.php

The latest version of WordPress MU can be downloaded here.