The attack at the STEM School Highlands Ranch, near Denver, Colorado, the US, took place on Tuesday, police said, BBC News reported.
Both attackers have now been arrested.
Highlands Ranch is just 8km (5 miles) from Columbine High School — the site of one of the US's worst school shootings 20 years ago.
This is believed to be the 115th mass shooting in the US in 2019.
Just before 14:00 local time (20:00 GMT) the attackers "walked into the STEM school, got deep inside the school and engaged students in two separate locations", Douglas County Sheriff Tony Spurlock said.
One suspect was a male youth, while the other was an adult man. Both were pupils at the school.
Spurlock said the school contacted the emergency services ‘almost immediately’, and that officers arrived at the scene about two minutes later.
The school was closed and placed on lockdown as police attended the scene. It was eventually lifted an hour later, at about 15:00 local time (21:00 GMT).
One 18-year-old male pupil was fatally shot. A handgun was later recovered at the scene.
"We have no information about anyone being targeted," Spurlock said, adding that it was too early to come to any conclusions.
One parent, named in local media as Fernando Montoya, said his 17-year-old son was shot three times and wounded.
"He said a guy pulled a pistol out of a guitar case and started to shoot," Montoya told ABC affiliate Denver 7.
Colorado Governor Jared Polis tweeted he would send extra police officers to the scene.
The White House also tweeted its condolences to the victims, while spokesman Judd Deere said President Donald Trump "has been briefed and continues to monitor the ongoing situation".
And another parent Steve Holley tweeted that he had been here before.
"This is the third time I've had to pick up my boys from school due to a lockdown," he wrote.