Police warned of an "acute terror" situation in the locked-down southern German city, which saw panicked shoppers fleeing the mall as armed police roamed the streets in the search for the attackers.
"We suspect terrorism," a Munich police spokesman told AFP.
The shooting spree began before 2130 IST at a McDonald's restaurant and continued on a nearby street before the gunmen moved into the OEZ shopping centre, a police spokeswoman said.
Germany has so far escaped the kind of large-scale jihadist attacks seen in France.
More From This Section
But it is the third strike against civilian targets in Europe in just over a week, following an axe rampage on a train in the same German state of Bavaria on Monday and the truck attack in France on July 14.
German news agency DPA quoted police as warning of an "acute terror situation" with three assailants at large armed with "long guns".
A video posted on social media appeared to show a man dressed in black walking away from the McDonald's while firing repeatedly on people as they fled.
Europe has been on alert for terrorism in the wake of a string of attacks in neighbouring France and Belgium claimed by the Islamic State jihadist group.
The OEZ shopping centre was surrounded by armed police and emergency vehicles, while a helicopter buzzed overhead.
Emergency vehicles were seen in the streets outside, as shoppers rushed away from the mall, some carrying children in their arms.
"Attention -- avoid the neighbourhood around the OEZ. Stay in your homes. Leave the street," a Munich police tweet said.
"Our hearts go out to those who may have been injured. It's still an active situation, and Germany's one of our closest allies, so we are going to pledge all the support that they may need in dealing with these circumstances," Obama said.
The shooting comes just days after a teenage asylum seeker went on a rampage with an axe and a knife on a regional train on Monday near Wuerzburg, also in Bavaria, injuring five people, two of them critically.
The Munich mall is located near the stadium for the 1972 Olympics and the athletes' village which was the site of the massacre of Israeli athletes by the Palestinian Black September group.