Seven al-Qaeda-linked militants on a suicide mission attacked the UN compound with a truck bomb and then poured inside, killing at least 13 people before dying in the assault.
At least three foreigners were slain during the raid in the Somali capital of Mogadishu, where the United Nations expanded its presence this year, about 18 months after Islamic insurgents were pushed from the seaside city.
The militant group al-Shabab claimed responsibility for the attack, calling the UN "a merchant of death".
African Union forces expelled al-Shabab from Mogadishu in August 2011, ending years of daily violence that had caused the rest of the world to shun the capital for two decades. After the ouster of al-Shabab, the international community had started trickling back into the capital, and the UN began moving in its personnel from Kenya, a process that accelerated in recent weeks.
This week's attack, however, underscores the fragile security situation and will force the UN and embassies to review safety plans and decide if they have the resources to withstand a sustained assault from al-Shabab.
UN Secretary-General Ban Ki-moon, who expressed outrage over the attack, commended the UN security guards who defended the compound, said UN deputy spokesman Eduardo del Buey.
The UN Security Council later reiterated its willingness "to take action against those whose behaviour threatens the peace, stability or security of Somalia".
Susan Rice, the US ambassador to the UN, condemned the "brazen assault on civilians working for peace".
Somali Prime Minister Abdi Farah Shirdon said he was appalled by "such barbaric violence". An African Union official, Mahamet Saleh Annadif, condemned the "cowardly" attack and sent condolences to the families of the victims.
The attack began about 11:30am when the seven al-Shabab militants from what the group called its martyrdom brigade blew up an explosives-laden truck at the gates of the UN compound and gunmen rushed in, said a UN official who insisted on anonymity because he was not an official spokesman.
At least two other blasts followed, said Ben Parker, a spokesman for the UN Assistance Mission in Somalia.
Dozens of staff from UN humanitarian and development agencies were in the compound, and many were moved to a secure bunker in the complex, Parker said. Later, they were evacuated to a secure military base and airport complex across the street, where UN-backed African Union military forces are based.
Fadumo Hussein, who was in her shop near the scene of the attack, described a narrow escape.
"It started with an earsplitting explosion, followed by heavy gunfire," she said, showing holes made by bullets on her shop. "I crouched and then crawled like an animal. I am very lucky. It was a shocking moment."
African Union and Somali security forces responded and took control of the compound by 12:30pm.
An Associated Press reporter who went into the bullet-scarred compound afterward saw two bodies of what appeared to be al-Shabab attackers wearing Somali military uniforms. The seven attackers died, said a UN official who insisted on anonymity because he was not an official spokesman.
Del Buey said one UN international staff member, three contractors, and four Somali security guards died at the compound. A number of Somali civilians were also killed and wounded outside the compound, he said at UN headquarters.
Ambulance driver Mohamed Ali said he took away five dead civilians and 10 people who were wounded.
Among the dead were two South Africans from the company Denel Mechem who were working to get rid of land mines, said Vuyelwa Qinga, a spokeswoman for Denel, a manufacturer of defence equipment.
"There was not very much time to get into the safe area," Parker said.
The top UN official on Somalia, Nicholas Kay, who was not in the compound when it was attacked, said he was horrified by the attack.
"The United Nations common compound houses UN personnel working on humanitarian and development issues for the Somali people. This was an act of blatant terrorism and a desperate attempt to knock Somalia off its path of recovery and peace-building," he said.
A statement sent on al-Shabab's Twitter feed said: "The UN, a merchant of death & a satanic force of evil, has a long inglorious record of spreading nothing but poverty, dependency & disbelief."
Ban had visited Mogadishu in December to announce the return of the UN's political office to the country.
Britain's UN Ambassador Mark Lyall Grant, the current Security Council president, said actions that could be taken after the attack include reinforcing security in Mogadishu and widening sanctions against al-Shabab.