Hundreds of panicked students fled the building, running past heavily armed, helmeted police officers while others huddled in closets.
Parents raced to the school of 3,300 students and a nearby hotel that was set up as a checkpoint to find their children.
"This has been a day we've seen the worst in humanity," Broward County Public Schools Superintendent Robert Runcie said Wednesday.
The assailant wore a gas mask as he stalked into the school carrying a rifle, ammunition cartridges and smoke grenades, then pulled a fire alarm, prompting students and staff to pour from classrooms into hallways, according to Florida's two U.S. senators, who were brief by federal authorities.
Cruz had recently moved in with another family after his mother's death in November, according to Jim Lewis, a lawyer representing the family and local media, bringing his AR-15 along with his other belongings.
The family believed Cruz was depressed but attributed that to his mother's death, not mental illness.
"They didn't see any danger. They didn't see any kind of predilection this was going to happen," Lewis told CNN.
Cruz may have left warning signs on social media. Buzzfeed reported that a person named Nikolas Cruz left a comment under a YouTube video that read "I'm going to be a professional school shooter." The man who posted the video was alarmed and contacted the FBI, Buzzfeed reported.
Reuters was unable to immediately confirm those details.
Colton Haab, a 17-year-old junior and member of the Junior Reserve Officer Training Corps at the high school, said he realized the alarms were not a drill after hearing several shots fired and learning that three people had been shot.
"That for me changed it to an active shooter scenario," he said. Haab rushed to his ROTC room and helped usher several dozen students inside, barricading them behind curtains made of Kevlar, a material used to make bullet-proof vests.
"We grabbed two pieces of two-by-four, a fire extinguisher and a chair," Haab said. "If he was going to try to come in the room we were going to try to stop him with whatever we had."
— The Associated Press contributed to this report.