One of the suspects is also believed to be dead, bringing the total to nine.
The southern city was in lockdown after the shootings, which saw panicked shoppers fleeing the Olympia mall as anti-terror police launched a massive operation to track down the assailants.
“We suspect terrorism,” a police spokesman in the Bavarian capital said, but there were no immediate indications of an Islamist link.
A video posted on social media appeared to show a man dressed in black walking away from a McDonald's restaurant while firing repeatedly on people as they fled screaming.
Germany has so far escaped the kind of large-scale jihadist attacks seen in neighbouring France and the motives and identities of the gunmen were not yet known.
Police said up to three shooters were still at large and reported to be armed with “long guns”.
Munich's main train station was evacuated and metro and bus transport in the city suspended while residents were ordered to stay in their homes, leaving the streets largely deserted.
Chancellor Angela Merkel will convene her security council on Saturday to address the deadly rampage in the European economic powerhouse which took in more than one million migrants and refugees last year.
“We are determined to do everything we can so that terror and inhuman violence stand no chance in Germany,” her chief of staff Peter Altmaier said.
It is the third strike against civilian targets in Europe in eight days, following an axe rampage on a train in the same German state of Bavaria on Monday and the truck attack in France on July 14.
One spokesman said the body of a man had been found near the mall and investigators were trying to determine whether he was one of the assailants.
Another video appeared to show a gunman on the roof of a parking garage as he exchanged insults with people on a nearby balcony who referred to him a foreigner.
“I'm German, I was born here,” the assailant is heard to reply.
The spree began before 1600 GMT at the McDonald's and continued on a nearby street before the gunmen moved into the Olympia centre — which lies not far from the scene of the 1972 Olympics massacre.
Shoppers rushed away from the mall, some carrying children in their arms, as the building was surrounded by armed police and emergency vehicles, while helicopters buzzed overhead.
Europe has been on alert for terrorism in the wake of a string of attacks in neighbouring France and Belgium claimed by the Islamic State jihadist group.
German President Joachim Gauck said he was “horrified” by the “murderous attack”, while Interior Minister Thomas de Maiziere, who was on a flight to New York when the shooting began, will return to Germany.
US President Barack Obama and French counterpart Francois Hollande voiced staunch support for their close ally.
“Our hearts go out to those who may have been injured. It's still an active situation, and Germany's one of our closest allies, so we are going to pledge all the support that they may need in dealing with these circumstances,” Obama said.
Austria said it has “significantly” tightened security measures in states sharing a border with Germany and put its elite Cobra police force on high alert.
The Munich mall is located near the stadium for the 1972 Olympics and the athletes' village which was the site of the hostage-taking and massacre of Israeli athletes by the Palestinian Black September group during the Games.
The shooting coincides with the fifth anniversary of the the massacre of 77 people in Norway by rightwing fanatic Anders Behring Breivik.
It also comes just days after a teenage asylum seeker went on a rampage with an axe and a knife on a regional train on Monday near Wuerzburg, also in Bavaria, injuring five people.
De Maiziere had said the teenager was believed to be a “lone wolf” who appeared to have been “inspired” by IS but was not a member of the jihadist network.
Flow of migrants
The train rampage triggered calls by politicians in Bavaria to impose an upper limit on the number of refugees coming into Germany — many of them via the southern state.
A record 1.1 million migrants and refugees were let in to Germany last year, with Syrians making up the largest group followed by Afghans.
The mall shooting came just eight days after 31-year-old Mohamed Lahouaiej Bouhlel used a truck to mow down 84 people, including children, in the French Riviera city of Nice.
It was the third major attack on French soil in the past 18 months, after the jihadist carnage in Paris in November 2015 and the shootings at satirical magazine Charlie Hebdo and a kosher supermarket in January 2015.
In March, IS claimed suicide bombings at Brussels airport and a city metro station that left 32 people dead.
In May, a mentally unstable 27-year-old man carried out a knife attack on a regional train in Bavaria, killing one person and injuring three others.